Debian
Page 13 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0808 | Critical | 9.8 | 2024-01-24 | Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chro… |
CVE-2024-0755 | High | 8.8 | 2024-01-23 | Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-0753 | Medium | 6.5 | 2024-01-23 | In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunder… |
CVE-2024-0751 | High | 8.8 | 2024-01-23 | A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 11… |
CVE-2024-0750 | High | 8.8 | 2024-01-23 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affect… |
CVE-2024-0749 | Medium | 4.3 | 2024-01-23 | A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firef… |
CVE-2024-0747 | Medium | 6.5 | 2024-01-23 | When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy… |
CVE-2024-0746 | Medium | 6.5 | 2024-01-23 | A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunde… |
CVE-2024-0742 | Medium | 4.3 | 2024-01-23 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent… |
CVE-2024-0741 | Medium | 6.5 | 2024-01-23 | An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox… |
CVE-2023-50447 | High | 8.1 | 2024-01-19 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which wa… |
CVE-2023-6816 | Critical | 9.8 | 2024-01-18 | A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbit… |
CVE-2024-20952 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20926 | Medium | 5.9 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported ver… |
CVE-2024-20918 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-0567 | High | 7.5 | 2024-01-16 | A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating… |
CVE-2023-6040 | High | 7.8 | 2024-01-12 | An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family)… |
CVE-2023-51782 | High | 7.0 | 2024-01-11 | An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition. |
CVE-2023-51781 | High | 7.0 | 2024-01-11 | An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition. |
CVE-2023-51780 | High | 7.0 | 2024-01-11 | An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition. |
CVE-2024-22049 | Medium | 5.3 | 2024-01-04 | httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename… |
CVE-2023-6270 | High | 7.0 | 2024-01-04 | A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`… |
CVE-2023-7101 | High | 7.8 | 2023-12-24 | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE)… |
CVE-2023-51714 | Critical | 9.8 | 2023-12-24 | An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/… |
CVE-2023-51766 | Medium | 5.3 | 2023-12-24 | Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e… |
CVE-2023-7008 | Medium | 5.9 | 2023-12-23 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signatur… |
CVE-2023-7024 | High | 8.8 | 2023-12-21 | Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-6932 | High | 7.8 | 2023-12-19 | A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be expl… |
CVE-2023-6931 | High | 7.8 | 2023-12-19 | A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A p… |
CVE-2023-6873 | High | 8.8 | 2023-12-19 | Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-6867 | Medium | 6.1 | 2023-12-19 | The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possib… |
CVE-2023-6865 | Medium | 6.5 | 2023-12-19 | `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have… |
CVE-2023-6864 | High | 8.8 | 2023-12-19 | Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-6863 | High | 8.8 | 2023-12-19 | The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnera… |
CVE-2023-6862 | High | 8.8 | 2023-12-19 | A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 1… |
CVE-2023-6861 | High | 8.8 | 2023-12-19 | The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6… |
CVE-2023-6860 | Medium | 6.5 | 2023-12-19 | The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affe… |
CVE-2023-6859 | High | 8.8 | 2023-12-19 | A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Fi… |
CVE-2023-6858 | High | 8.8 | 2023-12-19 | Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunder… |
CVE-2023-6857 | Medium | 5.3 | 2023-12-19 | When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Uni… |
CVE-2023-6856 | High | 8.8 | 2023-12-19 | The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an att… |
CVE-2023-50762 | Medium | 4.3 | 2023-12-19 | When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text w… |
CVE-2023-50761 | Medium | 4.3 | 2023-12-19 | The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare t… |
CVE-2023-51385 | Medium | 6.5 | 2023-12-18 | In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansio… |
CVE-2023-51384 | Medium | 5.5 | 2023-12-18 | In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of… |
CVE-2023-48795 | Medium | 5.9 | 2023-12-18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks… |
CVE-2023-5115 | Medium | 6.3 | 2023-12-18 | An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim… |
CVE-2023-6478 | High | 7.6 | 2023-12-13 | A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may le… |
CVE-2023-6377 | High | 7.8 | 2023-12-13 | A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and… |
CVE-2023-42883 | Medium | 5.5 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, tvOS 17.2… |
CVE-2023-6186 | High | 8.3 | 2023-12-11 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected ver… |
CVE-2023-6185 | High | 8.3 | 2023-12-11 | Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugi… |
CVE-2023-45866 | Medium | 6.3 | 2023-12-08 | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboar… |
CVE-2023-6512 | Medium | 6.5 | 2023-12-06 | Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe… |
CVE-2023-6511 | Medium | 4.3 | 2023-12-06 | Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML p… |
CVE-2023-6510 | High | 8.8 | 2023-12-06 | Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to… |
CVE-2023-6509 | High | 8.8 | 2023-12-06 | Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction… |
CVE-2023-6508 | High | 8.8 | 2023-12-06 | Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-40462 | High | 7.5 | 2023-12-04 | The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial… |
CVE-2023-42917 | High | 8.8 | 2023-11-30 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2… |
CVE-2023-42916 | Medium | 6.5 | 2023-11-30 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Pr… |
CVE-2023-6351 | High | 8.8 | 2023-11-29 | Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (C… |
CVE-2023-6350 | High | 8.8 | 2023-11-29 | Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (C… |
CVE-2023-6348 | High | 8.8 | 2023-11-29 | Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2023-6347 | High | 8.8 | 2023-11-29 | Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2023-6346 | High | 8.8 | 2023-11-29 | Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-6345 | Critical | 9.6 | 2023-11-29 | Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2023-5981 | Medium | 5.9 | 2023-11-28 | A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct… |
CVE-2023-6212 | High | 8.8 | 2023-11-21 | Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-6209 | Medium | 6.5 | 2023-11-21 | Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. T… |
CVE-2023-6208 | High | 8.8 | 2023-11-21 | When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboa… |
CVE-2023-6207 | High | 8.8 | 2023-11-21 | Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. |
CVE-2023-6206 | Medium | 5.4 | 2023-11-21 | The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact t… |
CVE-2023-6205 | Medium | 6.5 | 2023-11-21 | It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash. This vulnerability… |
CVE-2023-6204 | Medium | 6.5 | 2023-11-21 | On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on t… |
CVE-2023-6174 | Medium | 6.3 | 2023-11-16 | SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file |
CVE-2023-6112 | High | 8.8 | 2023-11-15 | Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-5997 | High | 8.8 | 2023-11-15 | Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2023-23583 | High | 8.8 | 2023-11-14 | Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation o… |
CVE-2023-46850 | Critical | 9.8 | 2023-11-11 | Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a r… |
CVE-2023-46849 | High | 7.5 | 2023-11-11 | Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could… |
CVE-2023-46734 | Medium | 6.1 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to ver… |
CVE-2023-5996 | High | 8.8 | 2023-11-08 | Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-47272 | Medium | 6.1 | 2023-11-06 | Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download). |
CVE-2023-5859 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local H… |
CVE-2023-5858 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML… |
CVE-2023-5857 | High | 8.8 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malici… |
CVE-2023-5856 | High | 8.8 | 2023-11-01 | Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to poten… |
CVE-2023-5855 | High | 8.8 | 2023-11-01 | Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
CVE-2023-5854 | High | 8.8 | 2023-11-01 | Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2023-5853 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromi… |
CVE-2023-5852 | High | 8.8 | 2023-11-01 | Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2023-5851 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page… |
CVE-2023-5850 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Ch… |
CVE-2023-5849 | High | 8.8 | 2023-11-01 | Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-5482 | High | 8.8 | 2023-11-01 | Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTM… |
CVE-2023-5480 | Medium | 6.1 | 2023-11-01 | Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Ch… |
CVE-2023-46604 | Critical | 10.0 | 2023-10-27 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a… |
CVE-2023-34059 | High | 7.4 | 2023-10-27 | open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack… |
CVE-2023-34058 | High | 7.1 | 2023-10-27 | VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/… |