Suse Linux Enterprise Debuginfo vulnerabilities

55 CVEs affecting Suse Linux Enterprise Debuginfo, 7 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-10195, published 2021-06-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability, published 2015-07-29. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 99.4% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2009-3953: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability, published 2010-01-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 83.2% chance of exploitation in the next 30 days. The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D…
CVE-2009-4324: Adobe Acrobat and Reader Use-After-Free Vulnerability, published 2009-12-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 81.9% chance of exploitation in the next 30 days. Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to…
CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.7% chance of exploitation in the next 30 days. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability, published 2015-08-08. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 68.6% chance of exploitation in the next 30 days. The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain…
CVE-2015-2590: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability, published 2015-07-16. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 25.5% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors…
CVE-2015-7547, published 2016-02-18. High severity, CVSS 8.1. EPSS: 91% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a…
CVE-2017-14491, published 2017-10-04. Critical severity, CVSS 9.8. EPSS: 84.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
CVE-2009-1185, published 2009-04-17. High severity, CVSS 7.2. EPSS: 80.6% chance of exploitation in the next 30 days. udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

Latest

CVE-2018-10195, published 2021-06-02. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.
CVE-2015-5239, published 2020-01-23. Medium severity, CVSS 6.5. EPSS: 3.6% chance of exploitation in the next 30 days. Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
CVE-2019-11038, published 2019-06-19. Medium severity, CVSS 5.3. EPSS: 4.3% chance of exploitation in the next 30 days. When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below…
CVE-2017-18017, published 2018-01-03. Critical severity, CVSS 9.8. EPSS: 52.8% chance of exploitation in the next 30 days. The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and…
CVE-2015-5300, published 2017-07-21. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to…
CVE-2015-5219, published 2017-07-21. High severity, CVSS 7.5. EPSS: 6.1% chance of exploitation in the next 30 days. The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service…
CVE-2015-5194, published 2017-07-21. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
CVE-2015-8567, published 2017-04-13. High severity, CVSS 7.7. EPSS: 5.6% chance of exploitation in the next 30 days. Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).
CVE-2014-9853, published 2017-03-17. Medium severity, CVSS 5.5. EPSS: 1.8% chance of exploitation in the next 30 days. Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.