Oracle Vm Server vulnerabilities

39 CVEs affecting Oracle Vm Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-22024, published 2023-09-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability, published 2015-07-29. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 99.4% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2016-2776, published 2016-09-28. High severity, CVSS 7.5. EPSS: 89.5% chance of exploitation in the next 30 days. buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service…
CVE-2015-8000, published 2015-12-16. Medium severity, CVSS 5.0. EPSS: 54.7% chance of exploitation in the next 30 days. db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class…
CVE-2015-3195, published 2015-12-06. Medium severity, CVSS 5.3. EPSS: 38.7% chance of exploitation in the next 30 days. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed…
CVE-2016-3115, published 2016-03-22. Medium severity, CVSS 6.4. EPSS: 35.5% chance of exploitation in the next 30 days. Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data,…
CVE-2016-5696, published 2016-08-06. Medium severity, CVSS 4.8. EPSS: 14.5% chance of exploitation in the next 30 days. net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind…
CVE-2016-4447, published 2016-06-09. High severity, CVSS 7.5. EPSS: 14% chance of exploitation in the next 30 days. The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted…
CVE-2015-8668, published 2016-01-08. Critical severity, CVSS 9.8. EPSS: 13.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service…
CVE-2016-7039, published 2016-10-16. High severity, CVSS 7.5. EPSS: 7.6% chance of exploitation in the next 30 days. The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the…
CVE-2016-4448, published 2016-06-09. Critical severity, CVSS 9.8. EPSS: 7% chance of exploitation in the next 30 days. Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

Latest

CVE-2023-22024, published 2023-09-20. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant. A malicious local user with…
CVE-2020-2571, published 2020-01-15. Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle VM Server for SPARC product of Oracle Systems (component: Templates). The supported version that is affected is 3.6. Easily exploitable vulnerability allows…
CVE-2017-3242, published 2017-01-27. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle VM Server for Sparc component of Oracle Sun Systems Products Suite (subcomponent: LDOM Manager). Supported versions that are affected are 3.2 and 3.4. Easily exploitable…
CVE-2016-3991, published 2016-09-21. High severity, CVSS 7.8. EPSS: 3.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary…
CVE-2016-3990, published 2016-09-21. High severity, CVSS 7.8. EPSS: 3.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code…
CVE-2016-3945, published 2016-09-21. High severity, CVSS 7.8. EPSS: 3.5% chance of exploitation in the next 30 days. Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial…
CVE-2016-3632, published 2016-09-21. High severity, CVSS 7.8. EPSS: 3.3% chance of exploitation in the next 30 days. The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.
CVE-2016-6198, published 2016-08-06. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service…