CVEs published in December 2016
584 vulnerabilities, 57 critical, 4 exploited.
- uclouvain openjpeg, redhat enterprise linux, enterprise linux for ibm z systems +2 more +4 moreopenjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted...7.8 High
- image-info project for perlperl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An...7.1 High
- xmltwig xml-twig for perlperl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity...9.1 Critical
- redhat enterprise linux, enterprise linux desktop, enterprise linux hpc node +2 more +4 moresudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and...4.4 Medium
- apache http server, debian linux, netapp clustered data ontap +8 more +10 moreApache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace...7.5 High
- apache http serverIn Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the...7.5 High
- apache http serverIn Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie...7.5 High
- netapp snap creator frameworkNetApp Snap Creator Framework before 4.3.1 discloses sensitive information which could be viewed...7.5 High
- bmc remedy action request systemRemedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset...7.5 High
- zlib, apple iphone os, mac os x +21 more +23 moreThe crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have...9.8 Critical
- zlib, apple iphone os, mac os x +17 more +19 moreThe inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to...8.8 High
- zlib, apple iphone os, mac os x +37 more +39 moreinffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by...9.8 Critical
- zlib, apple iphone os, mac os x +18 more +20 moreinftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by...8.8 High
- xenCMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to...3.3 Low
- xen, citrix xenserver +1 moreVMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions ...5.5 Medium
- xen, citrix xenserver +1 moreXen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service...6.0 Medium
- xenXen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging...7.8 High
- haxx curlThe verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when...9.8 Critical
- haxx curlThe verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when...8.1 High
php-ssh2Debianphp-ssh2 - regression updateNo score- curlcurl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point...5.9 Medium
- imagemagick, opensuse leap, opensuse +2 moreThe AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8...8.8 High
- imagemagick, debian linux +1 moreAn exploitable out of bounds write exists in the handling of compressed TIFF images in...7.5 High
- python-openxml project python-docxImproper Restriction of XML External Entity Reference in python-docx8.8 High
- imagemagickThe ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not...6.5 Medium
- dicom dcmtk, debian linux +1 moreStack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3...7.5 High
- rapid7 nexposeIn the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated...5.4 Medium
- horde groupwareCross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and...6.1 Medium
- roundcube webmailCross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote...6.1 Medium
- microsoft auto updater for macUntrusted search path vulnerability in Microsoft Auto Updater for Mac allows local users to gain...7.8 High
- microsoft office, word viewer +1 moreMicrosoft Office 2007 SP3, Office 2010 SP2, Word Viewer, Office for Mac 2011, and Office 2016 for...7.8 High
- microsoft edgeThe scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause...7.5 High
- microsoft edgeThe scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause...7.5 High
- microsoft windows 10, windows 7, windows 8.1 +5 more +7 moreThe Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2...5.5 Medium
- microsoft windows 10, windows 7, windows 8.1 +5 more +7 moreThe Installer in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...7.8 High
- microsoft office, office compatibility pack, office web apps +4 more +6 moreMicrosoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for...7.1 High
- microsoft office, office compatibility pack, office web apps +4 more +6 moreMicrosoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for...7.1 High
- microsoft publisherMicrosoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerab…7.8 High
- microsoft edgeThe scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause...7.5 High
- microsoft edge, internet explorer +1 moreThe scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers...7.5 High
- microsoft edgeThe scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause...7.5 High
- microsoft internet explorerMicrosoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or...8.8 High
- microsoft edge, internet explorer +1 moreCross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and...6.1 Medium
- microsoft edge, internet explorer +1 moreThe Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows...5.3 Medium
- microsoft edgeCross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject...6.1 Medium
- microsoft edge, internet explorer +1 moreMicrosoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute...7.5 High
- microsoft internet explorerMicrosoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information...5.3 Medium
- microsoft officeMicrosoft Office 2016 allows remote attackers to execute arbitrary code or cause a denial of...9.6 Critical
- microsoft office, office for mac +1 moreMicrosoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016...7.1 High
- Show moreLoading…