Debian
Page 17 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31137 | High | 7.5 | 2023-05-09 | MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerabi… |
CVE-2023-27954 | Medium | 6.5 | 2023-05-08 | The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS… |
CVE-2023-27932 | Medium | 5.5 | 2023-05-08 | This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9… |
CVE-2022-43681 | Medium | 6.5 | 2023-05-03 | An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (… |
CVE-2022-40318 | Medium | 6.5 | 2023-05-03 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), att… |
CVE-2022-40302 | Medium | 6.5 | 2023-05-03 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), att… |
CVE-2023-2468 | Medium | 4.3 | 2023-05-03 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to… |
CVE-2023-2467 | Medium | 4.3 | 2023-05-03 | Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a c… |
CVE-2023-2466 | Medium | 4.3 | 2023-05-03 | Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the contents of the security UI via a crafte… |
CVE-2023-2465 | Medium | 4.3 | 2023-05-03 | Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2023-2464 | Medium | 4.3 | 2023-05-03 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extens… |
CVE-2023-2463 | Medium | 4.3 | 2023-05-03 | Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to hide the contents of the Omnib… |
CVE-2023-2462 | Medium | 4.3 | 2023-05-03 | Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page… |
CVE-2023-2461 | High | 8.8 | 2023-05-03 | Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in specific UI interact… |
CVE-2023-2460 | High | 7.1 | 2023-05-03 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a maliciou… |
CVE-2023-2459 | Medium | 6.5 | 2023-05-03 | Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions via a crafted HTML… |
CVE-2023-0458 | Medium | 5.3 | 2023-04-26 | A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in poi… |
CVE-2023-0045 | Medium | 4.7 | 2023-04-25 | The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Informatio… |
CVE-2023-2269 | Medium | 4.4 | 2023-04-25 | A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Lin… |
CVE-2023-2007 | High | 7.8 | 2023-04-24 | The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An at… |
CVE-2023-29469 | Medium | 6.5 | 2023-04-24 | An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-de… |
CVE-2023-28484 | Medium | 6.5 | 2023-04-24 | In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFi… |
CVE-2023-31084 | Medium | 5.5 | 2023-04-24 | An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb… |
CVE-2023-1998 | Medium | 5.6 | 2023-04-21 | The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well… |
CVE-2023-2137 | High | 8.8 | 2023-04-19 | Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-2136 | Critical | 9.6 | 2023-04-19 | Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2023-2135 | High | 7.5 | 2023-04-19 | Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentia… |
CVE-2023-2134 | High | 8.8 | 2023-04-19 | Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via… |
CVE-2023-2133 | High | 8.8 | 2023-04-19 | Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via… |
CVE-2023-30608 | Medium | 5.5 | 2023-04-18 | sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regul… |
CVE-2023-28856 | Medium | 5.5 | 2023-04-18 | Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that… |
CVE-2023-26049 | Low | 2.4 | 2023-04-18 | Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or othe… |
CVE-2023-21968 | Low | 3.7 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected… |
CVE-2023-21967 | Medium | 5.9 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are O… |
CVE-2023-21954 | Medium | 5.9 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected ar… |
CVE-2023-21939 | Medium | 5.3 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are… |
CVE-2023-21938 | Low | 3.7 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected… |
CVE-2023-21937 | Low | 3.7 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected… |
CVE-2023-21930 | High | 7.4 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are O… |
CVE-2023-2033 | High | 8.8 | 2023-04-14 | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-1994 | Medium | 6.3 | 2023-04-12 | GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
CVE-2023-1993 | Medium | 6.3 | 2023-04-12 | LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
CVE-2023-1992 | Medium | 6.3 | 2023-04-12 | RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
CVE-2023-1872 | High | 7.8 | 2023-04-12 | A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lack… |
CVE-2023-1989 | High | 7.0 | 2023-04-11 | A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished jo… |
CVE-2023-1668 | High | 8.2 | 2023-04-10 | A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP hea… |
CVE-2020-11935 | Medium | 4.4 | 2023-04-07 | It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause… |
CVE-2023-29415 | Medium | 6.5 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow… |
CVE-2023-1855 | Medium | 6.3 | 2023-04-05 | A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw co… |
CVE-2023-1823 | Medium | 6.5 | 2023-04-04 | Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pa… |
CVE-2023-1822 | Medium | 6.5 | 2023-04-04 | Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chro… |
CVE-2023-1821 | Medium | 6.5 | 2023-04-04 | Inappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially hide the contents of the Omnibox (URL… |
CVE-2023-1820 | High | 8.8 | 2023-04-04 | Heap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interac… |
CVE-2023-1819 | Medium | 6.5 | 2023-04-04 | Out of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
CVE-2023-1818 | High | 8.8 | 2023-04-04 | Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-1817 | Medium | 6.5 | 2023-04-04 | Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2023-1816 | Medium | 6.5 | 2023-04-04 | Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigation spoofing via a… |
CVE-2023-1815 | High | 8.8 | 2023-04-04 | Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction t… |
CVE-2023-1814 | Medium | 6.5 | 2023-04-04 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass download checking via a… |
CVE-2023-1813 | Medium | 6.5 | 2023-04-04 | Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2023-1812 | High | 8.8 | 2023-04-04 | Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memory access via a craf… |
CVE-2023-1811 | High | 8.8 | 2023-04-04 | Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potenti… |
CVE-2023-1810 | High | 8.8 | 2023-04-04 | Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2022-36440 | High | 7.5 | 2023-04-03 | A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and s… |
CVE-2023-28879 | Critical | 9.8 | 2023-03-31 | In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp… |
CVE-2023-28756 | Medium | 5.3 | 2023-03-31 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters… |
CVE-2023-28755 | Medium | 5.3 | 2023-03-31 | A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. I… |
CVE-2023-27538 | Medium | 5.5 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH o… |
CVE-2023-27536 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect… |
CVE-2023-27535 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subs… |
CVE-2022-23125 | Critical | 9.8 | 2023-03-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vuln… |
CVE-2022-23124 | Critical | 9.8 | 2023-03-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit t… |
CVE-2022-23123 | Critical | 9.8 | 2023-03-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit t… |
CVE-2022-23122 | Critical | 9.8 | 2023-03-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vuln… |
CVE-2022-23121 | Critical | 9.8 | 2023-03-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vuln… |
CVE-2022-0194 | Critical | 9.8 | 2023-03-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vuln… |
CVE-2023-1380 | High | 7.1 | 2023-03-27 | A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issu… |
CVE-2023-1077 | High | 7.0 | 2023-03-27 | In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but… |
CVE-2023-28686 | High | 7.1 | 2023-03-24 | Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can ch… |
CVE-2023-0386 | High | 7.8 | 2023-03-22 | A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS… |
CVE-2022-42334 | Medium | 6.5 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42333 | High | 8.6 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42332 | High | 7.8 | 2023-03-21 | x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavai… |
CVE-2023-28466 | High | 7.0 | 2023-03-16 | do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free… |
CVE-2023-27530 | High | 7.5 | 2023-03-10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to… |
CVE-2023-27522 | High | 7.5 | 2023-03-07 | HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special ch… |
CVE-2023-0330 | Medium | 5.3 | 2023-03-06 | A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overfl… |
CVE-2023-1161 | Medium | 6.3 | 2023-03-06 | ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file |
CVE-2023-27635 | High | 7.8 | 2023-03-05 | debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (The path is shown to… |
CVE-2023-27561 | High | 7.0 | 2023-03-03 | runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must… |
CVE-2023-26604 | High | 7.8 | 2023-03-03 | systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl sta… |
CVE-2023-25221 | High | 7.8 | 2023-03-01 | Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function in motion.cc. |
CVE-2023-24758 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. This vulnerability… |
CVE-2023-24757 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function at fallback-motion.cc. This vulnerability… |
CVE-2023-24756 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function at sse-motion.cc. This vulnerability al… |
CVE-2023-24755 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at fallback-motion.cc. This vulnerability al… |
CVE-2023-24754 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. This vulnerability… |
CVE-2023-24752 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_hevc_epel_pixels_8_sse function at sse-motion.cc. This vulnerability a… |
CVE-2023-24751 | Medium | 6.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc_chroma function at motion.cc. This vulnerability allows attackers to cause a De… |
CVE-2023-27372 | Critical | 9.8 | 2023-02-28 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4… |