OP
Vendor
Openafs
36
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-10397 | OP Openafs Openafs | 7.8 | Nov 14 | A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code |
| CVE-2024-10396 | OP Openafs Openafs | 6.5 | Nov 14 | An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store… |
| CVE-2024-10394 | OP Openafs Openafs | 7.8 | Nov 14 | A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number,… |
| CVE-2019-18603 | OP Openafs Openafs | 5.9 | Oct 29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output variables are sent over the network to… |
| CVE-2019-18602 | OP Openafs Openafs | 7.5 | Oct 29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a peer |
| CVE-2019-18601 | OP Openafs Openafs | 7.5 | Oct 29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTE_Debug RPC calls to… |
| CVE-2018-16949 | OP Openafs Openafs | 7.5 | Sep 12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2 |
| CVE-2018-16948 | OP Openafs Openafs | 7.5 | Sep 12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2 |
| CVE-2018-16947 | OP Openafs Openafs | 9.8 | Sep 12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2 |
| CVE-2017-17432 | OP Openafs Openafs | 7.5 | Dec 6 | OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted… |
| CVE-2016-9772 | OP Openafs Openafs | 5.3 | Feb 6 | OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache partition, (2) fileserver vice partition,… |
| CVE-2016-4536 | OP Openafs Openafs | 5.3 | May 13 | The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes… |
| CVE-2016-2860 | OP Openafs Openafs | 6.5 | May 13 | The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and… |
| CVE-2015-8312 | OP Openafs Openafs | 7.8 | May 13 | Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input… |
| CVE-2015-7763 | OP Openafs Openafs | – | Nov 6 | rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which… |
| CVE-2015-7762 | OP Openafs Openafs | – | Nov 6 | rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement (ACK) packet, which… |
| CVE-2015-6587 | OP Openafs Openafs | – | Sep 2 | The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a… |
| CVE-2015-3286 | OP Openafs Openafs | – | Aug 12 | Buffer overflow in the Solaris kernel extension in OpenAFS before 1.6.13 allows local users to cause a denial of service (panic or deadlock) or possibly have other unspecified… |
| CVE-2015-3285 | OP Openafs Openafs | – | Aug 12 | The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC, which allows local users to cause a denial of service… |
| CVE-2015-3284 | OP Openafs Openafs | – | Aug 12 | pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands |
| CVE-2015-3283 | OP Openafs Openafs | – | Aug 12 | OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors |
| CVE-2015-3282 | OP Openafs Openafs | – | Aug 12 | vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network |
| CVE-2014-4044 | OP Openafs Openafs | – | Jun 17 | OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitialized memory access and crash) via… |
| CVE-2014-2852 | OP Openafs Openafs | – | Apr 14 | OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid… |
| CVE-2014-0159 | OP Openafs Openafs | – | Apr 14 | Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted… |
| CVE-2013-4135 | OP Openafs Openafs | – | Nov 5 | The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to… |
| CVE-2013-4134 | OP Openafs Openafs | – | Nov 5 | OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service… |
| CVE-2013-1795 | OP Openafs Openafs | – | Mar 14 | Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a… |
| CVE-2013-1794 | OP Openafs Openafs | – | Mar 14 | Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via… |
| CVE-2011-0430 | OP Openafs Openafs | – | Feb 18 | Double free vulnerability in the Rx server process in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions allows remote attackers to cause a denial of service and execute… |
| CVE-2011-0431 | OP Openafs Openafs | – | Feb 18 | The afs_linux_lock function in afs/LINUX/osi_vnodeops.c in the kernel module in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions does not properly handle errors, which… |
| CVE-2009-1251 | OP Openafs Openafs | – | Apr 9 | Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of… |
| CVE-2009-1250 | OP Openafs Openafs | – | Apr 9 | The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of… |
| CVE-2007-6599 | OP Openafs Openafs | – | Jan 4 | Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously… |
| CVE-2007-1507 | OP Openafs Openafs | – | Mar 20 | The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by… |
| CVE-2003-0028 | OP Openafs Openafs | – | Mar 25 | Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc,… |