Product:

Solaris

(Oracle)
Repositories • https://github.com/ImageMagick/ImageMagick
• https://github.com/krb5/krb5
• https://github.com/torvalds/linux
• https://github.com/newsoft/libvncserver
• https://github.com/wireshark/wireshark
#Vulnerabilities 542
Date Id Summary Products Score Patch Annotated
2015-10-21 CVE-2015-4801 Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality via unknown vectors related to Solaris Kernel Zones. Solaris N/A
2015-07-16 CVE-2015-4770 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to UNIX filesystem. Solaris N/A
2015-07-16 CVE-2015-4737 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth. Ubuntu_linux, Debian_linux, Mysql, Solaris N/A
2015-08-15 CVE-2015-4496 Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538. Firefox, Solaris N/A
2015-08-15 CVE-2015-4490 The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior. Ubuntu_linux, Firefox, Opensuse, Solaris N/A
2015-08-15 CVE-2015-4483 Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request. Firefox, Opensuse, Solaris N/A
2015-08-25 CVE-2015-4020 RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900. Solaris, Rubygems N/A
2015-05-19 CVE-2015-3988 Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate. Horizon, Solaris N/A
2015-06-24 CVE-2015-3900 RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." Solaris, Enterprise_linux, Ruby, Rubygems N/A
2015-08-20 CVE-2015-3219 Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class. Debian_linux, Horizon, Solaris N/A