Name Severity IntroduceBy Description Layer
CVE-2015-7547 High eglibc:2.19-0ubuntu6.6 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7575 Medium gnutls26:2.12.23-12ubuntu2.3 Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8540 Medium libpng:1.2.50-1ubuntu2.14.04.1 underflow read in png_check_keyword in pngwutil.c sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8472 Medium libpng:1.2.50-1ubuntu2.14.04.1 Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2011-5325 Medium busybox:1:1.21.0-1ubuntu1 path traversal vulnerability in busybox tar sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-5277 Medium eglibc:2.19-0ubuntu6.6 The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-1234 Medium eglibc:2.19-0ubuntu6.6 glob: buffer overflow with GLOB_ALTDIRFUNC due to incorrect NAME_MAX limit assumption sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2842 Medium openssl:1.0.1f-1ubuntu2.16 The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2037 Medium cpio:2.11+dfsg-1ubuntu1.1 The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8239 Medium sudo:1.8.9p5-1ubuntu1.2 race condition checking digests/checksums in sudoers sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-5602 Medium sudo:1.8.9p5-1ubuntu1.2 sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt." sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2781 Medium coreutils:8.21-1ubuntu5.3 nonpriv session can escape to the parent session by using the TIOCSTI ioctl sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8138 Medium ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 ntp: missing check for zero originate timestamp sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7977 Medium ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 reslist NULL pointer dereference sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7978 Medium ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 Stack exhaustion in recursive traversal of restriction list sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7511 Medium libgcrypt11:1.5.3-2ubuntu4.2 ECDH Key-Extraction via Low-Bandwidth Electromagnetic Attacks on PCs sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2381 Medium perl:5.18.2-2ubuntu1 environment variable confusion sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-3191 Medium pcre3:1:8.31-2ubuntu2.1 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8605 Medium isc-dhcp:4.2.4-7ubuntu12.3 ISC DHCP 4.x before 4.1-ESV-R12-P1 and 4.2.x and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-2667 Low python3.4:3.4.3-1ubuntu1~14.04.3 Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-9621 Low file:1:5.14-2ubuntu3.3 The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-9620 Low file:1:5.14-2ubuntu3.3 The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-9653 Low file:1:5.14-2ubuntu3.3 readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2013-4235 Low shadow:1:4.1.5.1-1ubuntu9.1 TOCTOU race conditions by copying and removing directory trees sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2090 Low libbsd:0.6.0-2ubuntu1 Heap buffer overflow in fgetwln function of libbsd sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-0245 Low dbus:1.6.18-0ubuntu4.3 D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-9645 Low busybox:1:1.21.0-1ubuntu1 modprobe wrongly accepts paths as module names sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2147 Low busybox:1:1.21.0-1ubuntu1 OOB heap write due to integer underflow sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2148 Low busybox:1:1.21.0-1ubuntu1 heap overflow in OPTION_6RD parsing sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-5044 Low gcc-4.8:4.8.4-2ubuntu1~14.04 Array memory allocations could cause an integer overflow and thus memory overflow issues at runtime. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-5276 Low gcc-4.8:4.8.4-2ubuntu1~14.04 The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8778 Low eglibc:2.19-0ubuntu6.6 hcreate((size_t)-1) should fail with ENOMEM sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-9761 Low eglibc:2.19-0ubuntu6.6 nan function unbounded stack allocation sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-5180 Low eglibc:2.19-0ubuntu6.6 DNS resolver NULL pointer dereference with crafted record type sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2013-2207 Low eglibc:2.19-0ubuntu6.6 pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8776 Low eglibc:2.19-0ubuntu6.6 Passing out of range data to strftime() causes a segfault sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8779 Low eglibc:2.19-0ubuntu6.6 catopen() Multiple unbounded stack allocations sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-8121 Low eglibc:2.19-0ubuntu6.6 DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over the database, which triggers the file pointer to be reset. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-1781 Low eglibc:2.19-0ubuntu6.6 Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8777 Low eglibc:2.19-0ubuntu6.6 The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-0797 Low openssl:1.0.1f-1ubuntu2.16 Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-0702 Low openssl:1.0.1f-1ubuntu2.16 The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-0705 Low openssl:1.0.1f-1ubuntu2.16 Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-0798 Low openssl:1.0.1f-1ubuntu2.16 Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-0799 Low openssl:1.0.1f-1ubuntu2.16 The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-1197 Low cpio:2.11+dfsg-1ubuntu1.1 cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-9488 Low less:458-2 The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-9114 Low util-linux:2.20.1-5.1ubuntu20.7 blkid command injection sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2013-0157 Low util-linux:2.20.1-5.1ubuntu20.7 (a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-1865 Low coreutils:8.21-1ubuntu5.3 "time of check to time of use" race condition fts.c sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-3238 Low pam:1.1.8-1ubuntu2 The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2013-7041 Low pam:1.1.8-1ubuntu2 The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-2583 Low pam:1.1.8-1ubuntu2 Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-0727 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 NTP statsdir cleanup cronjob insecure sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8158 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 Potential Infinite Loop in ntpq sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7973 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 Deja Vu: Replay attack on authenticated broadcast mode sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8140 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 ntpq vulnerable to replay attacks sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8139 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 Origin Leak: ntpq and ntpdc, disclose origin sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7976 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 ntpq saveconfig command allows dangerous characters in filenames sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7979 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 Off-path Denial of Service (DoS) attack on authenticated broadcast mode sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-7974 Low ntp:1:4.2.6.p5+dfsg-3ubuntu2.14.04.6 NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key." sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-2524 Low readline6:6.3-4ubuntu2 The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2013-7422 Low perl:5.18.2-2ubuntu1 Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-4330 Low perl:5.18.2-2ubuntu1 The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-2328 Low pcre3:1:8.31-2ubuntu2.1 PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8394 Low pcre3:1:8.31-2ubuntu2.1 PCRE before 8.38 mishandles the (?() and (?(R) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8391 Low pcre3:1:8.31-2ubuntu2.1 The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8390 Low pcre3:1:8.31-2ubuntu2.1 PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8382 Low pcre3:1:8.31-2ubuntu2.1 The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8387 Low pcre3:1:8.31-2ubuntu2.1 PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8393 Low pcre3:1:8.31-2ubuntu2.1 pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8386 Low pcre3:1:8.31-2ubuntu2.1 PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8380 Low pcre3:1:8.31-2ubuntu2.1 The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2015-8385 Low pcre3:1:8.31-2ubuntu2.1 PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2014-8625 Low dpkg:1.17.5ubuntu5.5 Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845
CVE-2016-2774 Low isc-dhcp:4.2.4-7ubuntu12.3 ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions. sha256:d89e1bee20d9cb344674e213b581f14fbd8e70274ecf9d10c514bab78a307845