CVE Vulnerability Advisory Database

[Affected Scope] Linux systems utilizing libuser versions before 0.56.13-8 and 0.60 before 0.60-7, specifically via the userhelper utility in the usermode package

[Impact] Local attackers can cause a Denial of Service (DoS) by corrupting the /etc/passwd file, or combine this with CVE-2015-3245 to achieve full root privilege escalation

[Mitigation] Immediately update the libuser and usermode packages to the latest patched versions using your system package manager

[Affected Scope] Systems running unpatched versions impacted by CVE-2014-6278

[Impact] GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Android devices powered by Qualcomm MSM chipsets running Linux kernel versions 2.6.x and 3.x

[Impact] Local attackers can exploit the /dev/msm_acdb device node to trigger a stack-based buffer overflow, leading to local privilege escalation (LPE) to root

[Mitigation] Apply official kernel patches from Qualcomm/Google, or restrict access permissions to the vulnerable /dev/msm_acdb device node

[Affected Scope] All Linux systems running Linux kernel versions up to and including 3.14.3

[Impact] Local attackers can exploit a race condition to corrupt kernel memory, leading to a denial of service (system crash) or full root privilege escalation

[Mitigation] Apply the latest kernel security updates provided by your OS vendor and reboot the system

[Affected Scope] Adobe Flash Player on Windows, macOS, Linux, and Adobe AIR/SDK on Android and desktop environments prior to specific patched versions

[Impact] Remote attackers can execute arbitrary code (RCE) and gain full control of the target system via crafted Flash content

[Mitigation] Upgrade to the patched versions immediately, or completely uninstall and disable Adobe Flash Player across all enterprise endpoints

[Affected Scope] Adobe Flash Player before 11.7.700.261, 11.8.x through 12.0.x before 12.0.0.44 on Windows/macOS, and before 11.2.202.336 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to visit a website containing a specially crafted Flash (.swf) file

[Mitigation] Immediately uninstall legacy Adobe Flash Player or upgrade to patched versions, and disable Flash execution in all web browsers

[Affected Scope] Linux kernel before version 3.5.5 running on v6k and v7 ARM platforms, including affected Android devices

[Impact] Local attackers can exploit missing address validation in get_user and put_user APIs to read or write arbitrary kernel memory, leading to full root privilege escalation

[Mitigation] Upgrade the Linux kernel to version 3.5.5 or higher, or apply the latest security patches provided by your OS/device vendor

[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via crafted JavaScript and ms-help: protocol handlers

[Mitigation] Apply the MS13-080 cumulative security update, or implement workarounds such as disabling hxds.dll loading

[Affected Scope] Microsoft Internet Explorer (IE) versions 8, 9, and 10 running on Windows environments.

[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the current user or cause a denial of service (memory corruption) via a crafted malicious website.

[Mitigation] Apply the official Microsoft security update (MS13-055), transition to modern secure browsers, or implement temporary workarounds such as disabling Active Scripting.

[Affected Scope] Linux kernel versions 2.6.37 through 3.8.8

[Impact] Local unprivileged users can exploit this vulnerability via a crafted perf_event_open system call to execute arbitrary code with root privileges

[Mitigation] Upgrade the Linux kernel to version 3.8.9 or higher, or restrict unprivileged access to performance events by configuring perf_event_paranoid

[Affected Scope] Linux kernel versions before 3.8.9, including certain Android 4.1.2 builds and embedded Linux systems

[Impact] Local attackers can exploit an integer overflow to map the entire kernel memory space with read-write permissions, leading to full root privilege escalation

[Mitigation] Upgrade the Linux kernel to version 3.8.9 or higher, and restrict access permissions to framebuffer device files

[Affected Scope] Adobe Flash Player versions before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 11.2.202.273 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to load a specially crafted SWF file

[Mitigation] Immediately uninstall Adobe Flash Player from all endpoints and servers, or disable Flash execution within web browsers and document viewers

[Affected Scope] Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows/macOS, and before 11.2.202.273 on Linux (specifically within Firefox plugin environments)

[Impact] Remote attackers can bypass the Firefox browser sandbox and execute arbitrary code on the host system via crafted malicious SWF content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player from all endpoints

[Affected Scope] Microsoft Internet Explorer versions 6, 7, and 8

[Impact] Remote attackers can execute arbitrary code with user privileges via a crafted malicious website

[Mitigation] Apply the official MS13-008 security update, transition to a modern browser, or apply EMET mitigations

[Affected Scope] Microsoft Office 2003 SP3, 2007 SP2/SP3, 2010 Gold/SP1, and systems utilizing Visual Basic for Applications (VBA)

[Impact] Local attackers can execute arbitrary code and escalate privileges by tricking a user into opening a document in a directory containing a malicious DLL

[Mitigation] Apply the official Microsoft security update (MS12-046) and restrict insecure DLL loading via registry modifications

[Affected Scope] Windows XP, Vista, 7, and Windows Server 2003, 2008 kernel-mode drivers (win32k.sys)

[Impact] Remote code execution (RCE) with kernel-level privileges via crafted TrueType font data in Word documents or web pages

[Mitigation] Apply official MS11-087 security patches or implement the T2EMBED.DLL registry/ACL workaround

[Affected Scope] Android OS 3.0 and 2.x versions prior to 2.3.4

[Impact] Local attackers can execute arbitrary code and escalate privileges to root by sending crafted netlink messages

[Mitigation] Upgrade the Android operating system to version 2.3.4 or later, or apply the official vendor security patches

[Affected Scope] Linux kernel versions before 2.6.36 with the Reliable Datagram Sockets (RDS) protocol module enabled

[Impact] Local unprivileged users can exploit this vulnerability via crafted sendmsg and recvmsg system calls to gain full root privileges

[Mitigation] Upgrade the Linux kernel to a patched version, or disable the RDS kernel module by blacklisting it if not required

[Affected Scope] Microsoft Internet Explorer versions 6, 7, and 8

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via a specially crafted web page

[Mitigation] Apply official cumulative security updates (MS10-090 or later), transition to modern browsers, or implement temporary workarounds