CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Fedoraproject » Fedora » 16 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-8837 119 DoS Exec Code Overflow 2016-03-30 2020-07-27
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long pathname in an ISO file.
2 CVE-2015-8836 119 DoS Overflow 2016-03-30 2017-02-19
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ZF block size in an ISO file, leading to a heap-based buffer overflow.
3 CVE-2013-4235 367 2019-12-03 2021-02-25
3.3
None Local Medium Not required None Partial Partial
shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees
4 CVE-2013-0237 79 XSS 2013-07-08 2013-07-08
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
5 CVE-2013-0170 416 DoS Exec Code 2013-02-08 2020-10-22
6.8
None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.
6 CVE-2012-6129 119 DoS Exec Code Overflow 2013-04-03 2013-04-03
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."
7 CVE-2012-6075 120 DoS Exec Code Overflow 2013-02-13 2020-08-11
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.
8 CVE-2012-5645 400 DoS 2019-12-30 2020-01-03
7.8
None Remote Low Not required None None Complete
A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive CPU consumption.
9 CVE-2012-4524 20 Bypass 2019-11-21 2019-12-04
5.0
None Remote Low Not required None Partial None
xlockmore before 5.43 'dclock' security bypass vulnerability
10 CVE-2012-4453 276 +Info 2012-10-09 2020-10-09
2.1
None Local Low Not required Partial None None
dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.
11 CVE-2012-4451 79 XSS 2020-01-03 2020-01-14
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
12 CVE-2012-3354 200 +Info 2012-11-20 2013-12-13
4.3
None Remote Medium Not required Partial None None
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.
13 CVE-2012-2095 20 1 +Priv 2014-04-07 2014-04-08
6.9
None Local Medium Not required Complete Complete Complete
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.
14 CVE-2012-2089 120 DoS Exec Code Overflow 2012-04-17 2021-11-10
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.
15 CVE-2012-1615 269 2019-12-06 2019-12-16
4.6
None Local Low Not required Partial Partial Partial
A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file.
16 CVE-2012-1568 Bypass 2013-03-01 2019-04-22
1.9
None Local Medium Not required None Partial None
The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.
17 CVE-2012-1180 416 +Info 2012-04-17 2021-11-10
5.0
None Remote Low Not required Partial None None
Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.
18 CVE-2012-1170 354 2019-11-14 2019-11-15
5.0
None Remote Low Not required None Partial None
Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough
19 CVE-2012-1169 200 +Info 2019-11-14 2019-11-18
5.0
None Remote Low Not required Partial None None
Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs.
20 CVE-2012-1168 20 2019-11-14 2019-11-22
6.4
None Remote Low Not required None Partial Partial
Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified.
21 CVE-2012-1161 200 +Info 2019-11-14 2019-11-15
4.0
None Remote Low ??? Partial None None
Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results
22 CVE-2012-1160 732 2019-11-14 2019-11-18
4.0
None Remote Low ??? None Partial None
Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php
23 CVE-2012-1159 200 +Info 2019-11-14 2019-11-15
4.0
None Remote Low ??? Partial None None
Moodle before 2.2.2: Overview report allows users to see hidden courses
24 CVE-2012-1158 200 +Info 2019-11-14 2019-11-18
4.0
None Remote Low ??? Partial None None
Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export
25 CVE-2012-1157 276 2019-11-14 2019-11-18
4.0
None Remote Low ??? Partial None None
Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
26 CVE-2012-1156 532 2019-11-14 2019-11-22
5.0
None Remote Low Not required Partial None None
Moodle before 2.2.2 has users' private files included in course backups
27 CVE-2012-1155 200 +Info 2019-11-14 2019-11-22
5.0
None Remote Low Not required Partial None None
Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to
28 CVE-2012-1149 189 DoS Exec Code Overflow 2012-06-21 2017-08-29
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
29 CVE-2012-1146 476 DoS 2012-05-17 2020-07-27
4.9
None Local Low Not required None None Complete
The mem_cgroup_usage_unregister_event function in mm/memcontrol.c in the Linux kernel before 3.2.10 does not properly handle multiple events that are attached to the same eventfd, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by registering memory threshold events.
30 CVE-2012-1115 79 XSS 2019-12-05 2019-12-09
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.
31 CVE-2012-1114 79 XSS 2019-12-05 2019-12-12
4.3
None Remote Medium Not required None Partial None
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
32 CVE-2012-1105 200 +Info 2019-12-05 2019-12-17
2.1
None Local Low Not required Partial None None
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
33 CVE-2012-0049 400 DoS 2019-11-07 2019-11-09
4.0
None Remote Low ??? None None Partial
OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.
34 CVE-2011-4930 134 DoS Exec Code 2014-02-10 2014-02-10
4.4
None Local Medium Not required Partial Partial Partial
Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log, (2) the filename of a file to be transferred, and possibly other unspecified vectors.
35 CVE-2011-4862 120 1 Exec Code Overflow 2011-12-25 2021-02-09
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
36 CVE-2011-4315 787 DoS Overflow 2011-12-08 2021-11-10
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.
37 CVE-2011-4088 200 +Info 2020-01-31 2020-02-05
5.0
None Remote Low Not required Partial None None
ABRT might allow attackers to obtain sensitive information from crash reports.
38 CVE-2011-3045 190 DoS Exec Code 2012-03-22 2020-04-14
6.8
None Remote Medium Not required Partial Partial Partial
Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.
39 CVE-2011-2726 863 Bypass 2019-11-15 2019-12-03
5.0
None Remote Low Not required Partial None None
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
40 CVE-2010-5109 189 DoS Overflow 2014-05-05 2014-05-05
4.3
None Remote Medium Not required None None Partial
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a crafted TNEF file, which triggers a buffer overflow.
Total number of vulnerabilities : 40   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.