HP Icewall Federation Agent vulnerabilities

18 CVEs affecting HP Icewall Federation Agent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-9597, published 2018-07-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-2182, published 2016-09-16. Critical severity, CVSS 9.8. EPSS: 46.1% chance of exploitation in the next 30 days. The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and…
CVE-2016-6306, published 2016-09-26. Medium severity, CVSS 5.9. EPSS: 41.7% chance of exploitation in the next 30 days. The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to…
CVE-2016-4447, published 2016-06-09. High severity, CVSS 7.5. EPSS: 14% chance of exploitation in the next 30 days. The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted…
CVE-2015-7498, published 2015-12-15. Medium severity, CVSS 5.0. EPSS: 7.2% chance of exploitation in the next 30 days. Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to…
CVE-2015-7497, published 2015-12-15. Medium severity, CVSS 5.0. EPSS: 7.2% chance of exploitation in the next 30 days. Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.
CVE-2016-4448, published 2016-06-09. Critical severity, CVSS 9.8. EPSS: 7% chance of exploitation in the next 30 days. Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
CVE-2016-3627, published 2016-05-17. High severity, CVSS 7.5. EPSS: 7% chance of exploitation in the next 30 days. The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack…
CVE-2015-7499, published 2015-12-15. Medium severity, CVSS 5.0. EPSS: 6.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
CVE-2015-7500, published 2015-12-15. Medium severity, CVSS 5.0. EPSS: 5.9% chance of exploitation in the next 30 days. The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect…
CVE-2015-8317, published 2015-12-15. Medium severity, CVSS 5.0. EPSS: 5.9% chance of exploitation in the next 30 days. The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML…

Latest

CVE-2016-9597, published 2018-07-30. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service…
CVE-2017-8945, published 2018-02-15. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Federation Agent version 3.0 was found.
CVE-2016-3705, published 2016-05-17. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to…
CVE-2015-8242, published 2015-12-15. Medium severity, CVSS 5.8. EPSS: 4.3% chance of exploitation in the next 30 days. The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read…