Debian
Page 16 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3772 | Medium | 5.5 | 2023-07-25 | A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privile… |
CVE-2023-38745 | Medium | 6.3 | 2023-07-25 | Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extrac… |
CVE-2023-20593 | Medium | 5.5 | 2023-07-24 | An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. |
CVE-2023-3863 | Medium | 6.4 | 2023-07-24 | A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges… |
CVE-2023-3417 | High | 7.5 | 2023-07-24 | Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while… |
CVE-2023-38633 | Medium | 5.5 | 2023-07-22 | A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem… |
CVE-2023-3776 | High | 7.8 | 2023-07-21 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev()… |
CVE-2023-3611 | High | 7.8 | 2023-07-21 | An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change… |
CVE-2023-3610 | High | 7.8 | 2023-07-21 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error… |
CVE-2023-3609 | High | 7.8 | 2023-07-21 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_inde… |
CVE-2023-34968 | Medium | 5.3 | 2023-07-20 | A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and dire… |
CVE-2023-34967 | Medium | 5.3 | 2023-07-20 | A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is… |
CVE-2023-34966 | High | 7.5 | 2023-07-20 | An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core un… |
CVE-2022-2127 | Medium | 5.9 | 2023-07-20 | An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the… |
CVE-2023-22049 | Low | 3.7 | 2023-07-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported ver… |
CVE-2023-22045 | Low | 3.7 | 2023-07-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2023-22044 | Low | 3.7 | 2023-07-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2023-22041 | Medium | 5.1 | 2023-07-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2023-22036 | Low | 3.7 | 2023-07-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versi… |
CVE-2023-22006 | Low | 3.1 | 2023-07-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2023-38403 | High | 7.5 | 2023-07-17 | iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. |
CVE-2023-21400 | Medium | 6.7 | 2023-07-13 | In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in… |
CVE-2023-21255 | High | 7.8 | 2023-07-13 | In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no addi… |
CVE-2023-3618 | Medium | 6.5 | 2023-07-12 | A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_… |
CVE-2023-36823 | High | 7.1 | 2023-07-06 | Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize… |
CVE-2023-35936 | Medium | 6.1 | 2023-07-05 | Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prio… |
CVE-2023-35001 | High | 7.8 | 2023-07-05 | Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network na… |
CVE-2023-31248 | High | 7.8 | 2023-07-05 | Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET… |
CVE-2023-37211 | High | 8.8 | 2023-07-05 | Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume t… |
CVE-2023-37208 | High | 7.8 | 2023-07-05 | When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR <… |
CVE-2023-37207 | Medium | 6.5 | 2023-07-05 | A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have le… |
CVE-2023-37202 | High | 8.8 | 2023-07-05 | Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-… |
CVE-2023-37201 | High | 8.8 | 2023-07-05 | An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR… |
CVE-2023-36053 | High | 7.5 | 2023-07-03 | In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial… |
CVE-2023-3338 | Medium | 6.5 | 2023-06-30 | A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system. |
CVE-2023-3389 | High | 7.8 | 2023-06-28 | A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll re… |
CVE-2023-3090 | High | 7.8 | 2023-06-28 | A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds w… |
CVE-2023-3422 | High | 8.8 | 2023-06-26 | Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2023-3421 | High | 8.8 | 2023-06-26 | Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-3420 | High | 8.8 | 2023-06-26 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-36664 | High | 7.8 | 2023-06-25 | Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). |
CVE-2023-36661 | High | 7.5 | 2023-06-25 | Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for exam… |
CVE-2023-3212 | Medium | 4.4 | 2023-06-23 | A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to ref… |
CVE-2023-34241 | Medium | 5.3 | 2023-06-22 | OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to ver… |
CVE-2023-2911 | High | 7.5 | 2023-06-21 | If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequen… |
CVE-2023-2828 | High | 7.5 | 2023-06-21 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to author… |
CVE-2023-35824 | High | 7.0 | 2023-06-18 | An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c. |
CVE-2023-35823 | High | 7.0 | 2023-06-18 | An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. |
CVE-2023-35788 | High | 7.8 | 2023-06-16 | An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classif… |
CVE-2023-3268 | High | 7.1 | 2023-06-16 | An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a… |
CVE-2023-30631 | High | 7.5 | 2023-06-14 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled di… |
CVE-2022-47184 | High | 7.5 | 2023-06-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic… |
CVE-2023-3217 | High | 8.8 | 2023-06-13 | Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-3216 | High | 8.8 | 2023-06-13 | Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-3215 | High | 8.8 | 2023-06-13 | Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-3214 | High | 8.8 | 2023-06-13 | Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2023-20867 | Low | 3.9 | 2023-06-13 | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest… |
CVE-2023-3141 | High | 7.1 | 2023-06-09 | A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash… |
CVE-2023-34969 | Medium | 6.5 | 2023-06-08 | D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedeskt… |
CVE-2023-0668 | Medium | 6.5 | 2023-06-07 | Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a… |
CVE-2023-0666 | Medium | 6.5 | 2023-06-07 | Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-ba… |
CVE-2023-2603 | High | 7.8 | 2023-06-06 | A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4Gi… |
CVE-2023-2602 | Low | 3.3 | 2023-06-06 | A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an… |
CVE-2023-33460 | Medium | 6.5 | 2023-06-06 | There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. |
CVE-2023-3079 | High | 8.8 | 2023-06-05 | Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-3111 | High | 7.8 | 2023-06-05 | A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by c… |
CVE-2023-34410 | Medium | 5.3 | 2023-06-05 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider w… |
CVE-2023-32324 | High | 7.5 | 2023-06-01 | OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch… |
CVE-2023-34256 | Medium | 5.5 | 2023-05-31 | An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_… |
CVE-2023-2952 | Medium | 5.3 | 2023-05-30 | XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file |
CVE-2023-34151 | Medium | 5.5 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurr… |
CVE-2023-2650 | Medium | 6.5 | 2023-05-30 | Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_… |
CVE-2023-32762 | Medium | 5.3 | 2023-05-28 | An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-securi… |
CVE-2023-32307 | High | 7.5 | 2023-05-26 | Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freesw… |
CVE-2023-2898 | Medium | 4.7 | 2023-05-26 | There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a… |
CVE-2023-2879 | Medium | 6.3 | 2023-05-26 | GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file |
CVE-2023-2858 | Medium | 5.3 | 2023-05-26 | NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2857 | Medium | 5.3 | 2023-05-26 | BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2856 | Medium | 5.3 | 2023-05-26 | VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2855 | Medium | 5.3 | 2023-05-26 | Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2854 | Medium | 5.3 | 2023-05-26 | BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-28321 | Medium | 5.9 | 2023-05-26 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternativ… |
CVE-2023-1667 | Medium | 6.5 | 2023-05-26 | A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of serv… |
CVE-2023-2002 | Medium | 6.8 | 2023-05-26 | A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows… |
CVE-2023-32067 | High | 7.5 | 2023-05-25 | c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP… |
CVE-2023-31130 | Medium | 4.1 | 2023-05-25 | c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2"… |
CVE-2023-2255 | Medium | 5.3 | 2023-05-25 | Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to… |
CVE-2023-0950 | High | 7.8 | 2023-05-25 | Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet… |
CVE-2023-28709 | High | 7.5 | 2023-05-22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTT… |
CVE-2023-33204 | High | 7.8 | 2023-05-18 | sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-202… |
CVE-2023-24805 | High | 8.8 | 2023-05-17 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use… |
CVE-2023-2726 | High | 8.8 | 2023-05-16 | Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web ap… |
CVE-2023-2725 | High | 8.8 | 2023-05-16 | Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2023-2724 | High | 8.8 | 2023-05-16 | Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-2723 | High | 8.8 | 2023-05-16 | Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit h… |
CVE-2023-2722 | High | 8.8 | 2023-05-16 | Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2023-2721 | High | 8.8 | 2023-05-16 | Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-2124 | High | 7.8 | 2023-05-15 | An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal… |
CVE-2023-2156 | High | 7.5 | 2023-05-09 | A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling o… |
CVE-2023-31490 | High | 7.5 | 2023-05-09 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function. |