Debian
Page 14 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46234 | Medium | 6.5 | 2023-10-26 | browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls… |
CVE-2023-5380 | Medium | 4.7 | 2023-10-25 | A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with mult… |
CVE-2023-5367 | High | 7.8 | 2023-10-25 | A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in t… |
CVE-2023-42852 | High | 8.8 | 2023-10-25 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14… |
CVE-2023-41983 | Medium | 6.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS… |
CVE-2023-5732 | Medium | 6.5 | 2023-10-25 | An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affect… |
CVE-2023-5730 | Critical | 9.8 | 2023-10-25 | Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-5728 | High | 7.5 | 2023-10-25 | During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerab… |
CVE-2023-5725 | Medium | 4.3 | 2023-10-25 | A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. This vulner… |
CVE-2023-5724 | High | 7.5 | 2023-10-25 | Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119… |
CVE-2023-5721 | Medium | 4.3 | 2023-10-25 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This… |
CVE-2023-5472 | High | 8.8 | 2023-10-25 | Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-5363 | High | 7.5 | 2023-10-25 | Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns du… |
CVE-2023-46316 | Medium | 5.5 | 2023-10-25 | In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. |
CVE-2023-45802 | Medium | 5.9 | 2023-10-23 | When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de… |
CVE-2023-31122 | High | 7.5 | 2023-10-23 | Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. |
CVE-2023-45145 | Low | 3.6 | 2023-10-18 | Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided… |
CVE-2023-5631 | Medium | 6.1 | 2023-10-18 | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program… |
CVE-2023-45871 | High | 7.5 | 2023-10-15 | An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for… |
CVE-2023-45133 | Critical | 9.3 | 2023-10-12 | Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to… |
CVE-2023-5486 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium… |
CVE-2023-5485 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML p… |
CVE-2023-5484 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chr… |
CVE-2023-5483 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2023-5481 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chro… |
CVE-2023-5479 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2023-5478 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2023-5477 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted… |
CVE-2023-5476 | High | 8.8 | 2023-10-11 | Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-5475 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to b… |
CVE-2023-5474 | High | 8.8 | 2023-10-11 | Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to p… |
CVE-2023-5473 | Medium | 6.3 | 2023-10-11 | Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2023-5218 | High | 8.8 | 2023-10-11 | Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2023-45648 | Medium | 5.3 | 2023-10-10 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81… |
CVE-2023-42795 | Medium | 5.3 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 th… |
CVE-2023-36478 | High | 7.5 | 2023-10-10 | Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer ove… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-43641 | High | 8.8 | 2023-10-09 | libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GN… |
CVE-2023-45364 | Medium | 5.3 | 2023-10-09 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is l… |
CVE-2023-45363 | High | 7.5 | 2023-10-09 | An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to ca… |
CVE-2023-39928 | High | 8.8 | 2023-10-06 | A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause m… |
CVE-2023-42755 | Medium | 6.5 | 2023-10-05 | A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, le… |
CVE-2023-43804 | Medium | 5.9 | 2023-10-04 | urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies o… |
CVE-2023-4911 | High | 7.8 | 2023-10-03 | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a… |
CVE-2023-44488 | High | 7.5 | 2023-09-30 | VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. |
CVE-2023-43655 | Medium | 6.4 | 2023-09-29 | Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php f… |
CVE-2023-5217 | High | 8.8 | 2023-09-28 | Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap… |
CVE-2023-5187 | High | 8.8 | 2023-09-28 | Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2023-5186 | High | 8.8 | 2023-09-28 | Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to pot… |
CVE-2023-42756 | Medium | 4.4 | 2023-09-28 | A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to th… |
CVE-2023-5197 | High | 7.8 | 2023-09-27 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and remov… |
CVE-2023-5176 | Critical | 9.8 | 2023-09-27 | Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-5171 | Medium | 6.5 | 2023-09-27 | During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potent… |
CVE-2023-5169 | Medium | 6.5 | 2023-09-27 | A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable… |
CVE-2023-41074 | High | 8.8 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web cont… |
CVE-2023-42753 | High | 7.0 | 2023-09-25 | An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array… |
CVE-2023-3550 | High | 7.3 | 2023-09-25 | Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a… |
CVE-2023-34319 | High | 7.8 | 2023-09-22 | The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in o… |
CVE-2023-43770 | Medium | 6.1 | 2023-09-22 | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcu… |
CVE-2023-4504 | High | 7.0 | 2023-09-21 | Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflo… |
CVE-2023-41993 | High | 8.8 | 2023-09-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is awa… |
CVE-2023-42464 | Critical | 9.8 | 2023-09-20 | A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encode… |
CVE-2019-19450 | Critical | 9.8 | 2023-09-20 | paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element i… |
CVE-2023-4236 | High | 7.5 | 2023-09-20 | A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal… |
CVE-2023-3341 | High | 7.5 | 2023-09-20 | The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by… |
CVE-2023-41900 | Low | 3.5 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `Op… |
CVE-2023-40167 | Medium | 5.3 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the con… |
CVE-2023-36479 | Low | 3.5 | 2023-09-15 | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have t… |
CVE-2023-4909 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML pag… |
CVE-2023-4908 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML pa… |
CVE-2023-4907 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTM… |
CVE-2023-4906 | Medium | 4.3 | 2023-09-12 | Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTM… |
CVE-2023-4905 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromi… |
CVE-2023-4904 | Medium | 4.3 | 2023-09-12 | Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a c… |
CVE-2023-4903 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a craf… |
CVE-2023-4902 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium… |
CVE-2023-4901 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML p… |
CVE-2023-4900 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a… |
CVE-2023-4921 | High | 7.8 | 2023-09-12 | A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc… |
CVE-2023-4863 | High | 8.8 | 2023-09-12 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write v… |
CVE-2023-41915 | High | 8.1 | 2023-09-09 | OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code… |
CVE-2023-4875 | Low | 2.2 | 2023-09-09 | Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 |
CVE-2023-4874 | Medium | 4.3 | 2023-09-09 | Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 |
CVE-2023-4623 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege esc… |
CVE-2023-4622 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() func… |
CVE-2023-4244 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race co… |
CVE-2023-4208 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is… |
CVE-2023-4207 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is c… |
CVE-2023-4206 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change… |
CVE-2023-4015 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when b… |
CVE-2023-3777 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_del… |
CVE-2023-4764 | Medium | 6.5 | 2023-09-05 | Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2023-4763 | High | 8.8 | 2023-09-05 | Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-4762 | High | 8.8 | 2023-09-05 | Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security s… |
CVE-2023-4761 | High | 8.1 | 2023-09-05 | Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an… |
CVE-2023-4781 | High | 7.8 | 2023-09-05 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. |
CVE-2023-41909 | High | 7.5 | 2023-09-05 | An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading t… |
CVE-2023-4752 | High | 7.8 | 2023-09-04 | Use After Free in GitHub repository vim/vim prior to 9.0.1858. |
CVE-2023-40569 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Wri… |