CVEs published in November 2015

382 vulnerabilities, 76 critical, 2 exploited.

• gnutls26 Ubuntu gnutls26 vulnerability USN-2821-1 Fix available No scoreNovember 30, 2015
• gnu gnutls, debian linux +1 more GnuTLS incorrectly validates the first byte of padding in CBC modes CVE-2015-8313 Fix available 5.9 MediumNovember 30, 2015
• qemu, debian linux, redhat enterprise linux desktop +5 more +7 more Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a... CVE-2015-7512 Fix available 9.0 CriticalNovember 30, 2015
• qemu, debian linux, xen +2 more Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest... CVE-2015-7504 Fix available 8.8 HighNovember 30, 2015
• python-cryptography Mageia, python-cryptography-vectors Mageia, python-pyasn1 Mageia +3 more +5 more Updated python-cryptography packages fix security vulnerability MGASA-2015-0460 Fix available No scoreNovember 27, 2015
• lightdm project lightdm Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the... CVE-2015-8316 Fix available 5.9 MediumNovember 27, 2015
• siemens simatic cp 343-1 firmware, simatic cp 443-1 firmware, simatic tim 3v-ie firmware +1 more +3 more A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions... CVE-2015-8214 9.7 HighNovember 27, 2015
• emc isilon onefs EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when... CVE-2015-6848 8.5 HighNovember 27, 2015
• imagemagick, oracle linux, redhat enterprise linux desktop +5 more +7 more Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers... CVE-2015-8896 Fix available 6.5 MediumNovember 27, 2015
• imagemagick Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to... CVE-2015-8895 Fix available 7.5 HighNovember 27, 2015
• qemu, debian linux +1 more The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of... CVE-2015-8345 Fix available 6.5 MediumNovember 27, 2015
• python-m2crypto Mageia Updated python-m2crypto packages fix security vulnerability MGASA-2015-0458 Fix available No scoreNovember 26, 2015
• python-pygments Mageia Updated python-pygments packages fix security vulnerability MGASA-2015-0456 Fix available No scoreNovember 26, 2015
• tigervnc, redhat enterprise linux desktop, enterprise linux hpc node +2 more +4 more XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer... CVE-2014-8241 Fix available 9.8 CriticalNovember 26, 2015
• ffmpeg The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x... CVE-2015-8363 Fix available 6.8 MediumNovember 26, 2015
• ibm java 2 sdk, java sdk, redhat enterprise linux desktop +6 more +8 more IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1 before SR3... CVE-2015-5006 2.1 LowNovember 26, 2015
• hp loadrunner, performance center +1 more Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12... CVE-2015-6857 7.2 HighNovember 26, 2015
• cisco asr 5000 series software Cisco ASR 5000 devices with software 16.0(900) allow remote attackers to cause a denial of... CVE-2015-6382 5.0 MediumNovember 26, 2015
• libcommons-collections3-java Debian libcommons-collections3-java - security update DLA-352-1 Fix available No scoreNovember 26, 2015
• eglibc Debian eglibc - security update DLA-350-1 Fix available No scoreNovember 26, 2015
• ffmpeg, canonical ubuntu linux +1 more The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3... CVE-2015-8365 Fix available 6.8 MediumNovember 26, 2015
• ffmpeg, canonical ubuntu linux +1 more Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2... CVE-2015-8364 Fix available 6.8 MediumNovember 26, 2015
• redmine, debian linux +1 more app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3... CVE-2015-8346 Fix available 5.3 MediumNovember 26, 2015
• xmlsoft libxml2, apple iphone os, mac os x +10 more +12 more The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers... CVE-2015-7500 Fix available 5.0 MediumNovember 26, 2015
• xmlsoft libxml2, apple iphone os, mac os x +12 more +14 more Heap-based buffer overflow in nokogiri CVE-2015-7499 Fix available 5.0 MediumNovember 26, 2015
• xmlsoft libxml2, canonical ubuntu linux, debian linux +6 more +8 more Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3... CVE-2015-7498 Fix available 5.0 MediumNovember 26, 2015
• xmlsoft libxml2, canonical ubuntu linux, debian linux +6 more +8 more Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9... CVE-2015-7497 Fix available 5.0 MediumNovember 26, 2015
• xmlsoft libxml2, apple iphone os, mac os x +10 more +12 more Nokogiri subject to DoS via libxml2 vulnerability CVE-2015-5312 Fix available 7.1 HighNovember 26, 2015
• debian dpkg, canonical ubuntu linux +1 more Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in... CVE-2015-0860 Fix available 7.5 HighNovember 26, 2015
• jenkins, redhat openshift container platform +1 more Jenkins CLI Deserialization of Untrusted Data vulnerability CVE-2015-8103 Public exploitFix available EPSS 91.9% 9.8 CriticalNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins allows Cross-Site Scripting (XSS) CVE-2015-5326 Fix available 4.3 MediumNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins allows Bypass of Access Restrictions CVE-2015-5325 Fix available 7.5 HighNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins allows Unauthorized Viewing of Queue API Information CVE-2015-5324 Fix available 5.0 MediumNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins allows Administrators to Access API Tokens CVE-2015-5323 Fix available 6.5 MediumNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins has Local File Inclusion Vulnerability CVE-2015-5322 Fix available 5.0 MediumNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins has Information Disclosure via Sidepanel Widget CVE-2015-5321 Fix available 5.0 MediumNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins allows Exposure of Sensitive Information to an Unauthorized Actor CVE-2015-5320 Fix available 5.0 MediumNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI CVE-2015-5319 Fix available 5.0 MediumNovember 25, 2015
• jenkins, redhat openshift +1 more Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack CVE-2015-5318 Fix available 6.8 MediumNovember 25, 2015
• jenkins, jenkins user interface (ui), redhat openshift +2 more Jenkins discloses project names via fingerprints CVE-2015-5317 In KEVFix available EPSS 23.0% 5.0 MediumNovember 25, 2015
• openstack ironic inspector Injection vulnerability that affects ironic-discoverd CVE-2015-5306 Fix available 6.8 MediumNovember 25, 2015
• redhat gluster storage OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python... CVE-2015-5242 Fix available 6.0 MediumNovember 25, 2015
• jenkins Jenkins improperly ensures trust separation CVE-2014-3665 Fix available 6.8 MediumNovember 25, 2015
• csl dualcom gprs cs2300-r firmware CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to... CVE-2015-7288 4.3 MediumNovember 25, 2015
• csl dualcom gprs cs2300-r firmware CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN... CVE-2015-7287 7.5 HighNovember 25, 2015
• csl dualcom gprs cs2300-r firmware CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic... CVE-2015-7286 6.4 MediumNovember 25, 2015
• csl dualcom gprs cs2300-r firmware CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication... CVE-2015-7285 5.8 MediumNovember 25, 2015
• cisco adaptive security appliance software The XML parser in the management interface in Cisco Adaptive Security Appliance (ASA) Software 8... CVE-2015-6379 6.8 MediumNovember 25, 2015
• debian linux The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie... CVE-2015-0859 Fix available 7.5 HighNovember 25, 2015
• smokeping, debian linux, fedoraproject fedora +2 more Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields. CVE-2013-4168 Fix available 6.1 MediumNovember 25, 2015
• Show olderLoading…