SO
Product
Solaris
On CISA KEVExploited in the wildRansomware-linked
558
CVEs
7
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 17High 85Medium 110Low 35
Watch
Add Solaris to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-1351 | – | Mar 30 | Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of… Affected: 11.2 |
| CVE-2015-2317 | – | Mar 25 | The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows… Affected: 11.2 |
| CVE-2015-2316 | – | Mar 25 | The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to… Affected: 11.2 |
| CVE-2015-2155 | – | Mar 24 | The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors Affected: 11.2 |
| CVE-2015-2190 | – | Mar 8 | epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32 bits in size, which allows remote attackers to cause a denial of service… Affected: 11.2 |
| CVE-2015-2189 | – | Mar 8 | Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to… Affected: 11.2 |
| CVE-2015-2188 | – | Mar 8 | epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote… Affected: 11.2 |
| CVE-2015-0829 | – | Feb 25 | Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code via a crafted MP4 video that is improperly handled during… Affected: 11.3 |
| CVE-2015-0828 | – | Feb 25 | Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to… Affected: 11.3 |
| CVE-2014-9512 | – | Feb 12 | rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path Affected: 10.0; 11.3 |
| CVE-2014-9674 | – | Feb 8 | The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote… Affected: 10.0; 11.2 |
| CVE-2014-9672 | – | Feb 8 | Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive… Affected: 10.0; 11.2 |
| CVE-2014-9671 | – | Feb 8 | Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: 10.0; 11.2 |
| CVE-2014-9670 | – | Feb 8 | Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer… Affected: 10.0; 11.2 |
| CVE-2014-9669 | – | Feb 8 | Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have… Affected: 10.0; 11.2 |
| CVE-2014-9666 | – | Feb 8 | The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote… Affected: 10.0; 11.2 |
| CVE-2014-9664 | – | Feb 8 | FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or… Affected: 10.0; 11.2 |
| CVE-2014-9663 | – | Feb 8 | The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote… Affected: 10.0; 11.2 |
| CVE-2014-9660 | – | Feb 8 | The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of… Affected: 10.0; 11.2 |
| CVE-2014-9659 | – | Feb 8 | cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to… Affected: 10.0; 11.2 |
| CVE-2014-9658 | – | Feb 8 | The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service… Affected: 10.0; 11.2 |
| CVE-2014-9657 | – | Feb 8 | The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service… Affected: 10.0; 11.2 |
| CVE-2015-1380 | – | Feb 3 | jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body Affected: 11.2 |
| CVE-2015-0432 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign… Affected: 11.3 |
| CVE-2015-0411 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via… Affected: 11.3 |
| CVE-2015-1196 | – | Jan 21 | GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file Affected: 11.2 |
| CVE-2015-1038 | – | Jan 21 | p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive Affected: 10.0; 11.2 |
| CVE-2015-0382 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server :… Affected: 11.3 |
| CVE-2015-0381 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server :… Affected: 11.3 |
| CVE-2015-0378 | – | Jan 21 | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Libc Affected: 11 |
| CVE-2015-0374 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related… Affected: 11.3 |
| CVE-2014-6568 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server… Affected: 11.3 |
| CVE-2014-9601 | – | Jan 16 | Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed Affected: 11.2 |
| CVE-2014-9496 | – | Jan 16 | The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an… Affected: 11.2 |
| CVE-2015-0564 | – | Jan 10 | Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to… Affected: 11.2 |
| CVE-2015-0561 | – | Jan 10 | asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a… Affected: 11.2 |
| CVE-2014-8145 | – | Dec 31 | Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or… Affected: 11.2 |
| CVE-2014-5353 | – | Dec 16 | The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows… Affected: 10; 11.2 |
| CVE-2014-8964 | – | Dec 16 | Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression,… Affected: 11.2 |
| CVE-2014-6052 | – | Dec 15 | The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to… Affected: 11.3 |
| CVE-2014-8124 | – | Dec 12 | OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows… Affected: 11.2 |
| CVE-2014-8094 | – | Dec 10 | Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension in X.Org Server (aka xserver and xorg-server) 1.7.0 through 1.16.x before 1.16.3 allows remote… Affected: 10; 11.2 |
| CVE-2014-7142 | – | Nov 26 | The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size Affected: 11.2 |
| CVE-2014-8991 | – | Nov 24 | pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user Affected: 11.2 |
| CVE-2014-8768 | – | Nov 20 | Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation… Affected: 11.2 |
| CVE-2014-6559 | – | Oct 15 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL… Affected: 11.3 |
| CVE-2014-6551 | – | Oct 15 | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality via vectors related to CLIENT:MYSQLADMIN Affected: 11.3 |
| CVE-2014-6530 | – | Oct 15 | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect confidentiality, integrity, and… Affected: 11.3 |
| CVE-2014-6507 | – | Oct 15 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and… Affected: 11.3 |
| CVE-2014-6500 | – | Oct 15 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via… Affected: 11.3 |
The 500 most important CVEs for this product (exploited first, then by severity)