Debian
Page 19 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23468 | Medium | 6.5 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-42329 | Medium | 5.5 | 2022-12-07 | Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2022-42328 | Medium | 5.5 | 2022-12-07 | Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2022-3643 | Medium | 6.5 | 2022-12-07 | Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network… |
CVE-2022-41325 | High | 7.8 | 2022-12-06 | An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or con… |
CVE-2022-24439 | High | 8.1 | 2022-12-06 | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a mali… |
CVE-2022-43548 | High | 8.1 | 2022-12-05 | A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easil… |
CVE-2022-35256 | Medium | 6.5 | 2022-12-05 | The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request… |
CVE-2022-35255 | Critical | 9.1 | 2022-12-05 | A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/c… |
CVE-2022-32221 | Critical | 9.8 | 2022-12-05 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIEL… |
CVE-2022-30123 | Critical | 10.0 | 2022-12-05 | A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger com… |
CVE-2022-30122 | High | 7.5 | 2022-12-05 | A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack. |
CVE-2022-46391 | Medium | 6.1 | 2022-12-04 | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. |
CVE-2021-37533 | Medium | 6.5 | 2022-12-03 | Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use… |
CVE-2022-46338 | Medium | 6.5 | 2022-11-30 | g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowin… |
CVE-2022-3088 | High | 7.8 | 2022-11-28 | UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12, UC-3100… |
CVE-2022-45442 | High | 8.8 | 2022-11-28 | Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An appli… |
CVE-2022-45939 | High | 7.8 | 2022-11-28 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system… |
CVE-2022-45934 | High | 7.8 | 2022-11-27 | An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets. |
CVE-2022-24999 | High | 7.5 | 2022-11-26 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ p… |
CVE-2022-44789 | High | 8.8 | 2022-11-23 | A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through me… |
CVE-2022-41946 | Medium | 4.7 | 2022-11-23 | pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa… |
CVE-2022-36227 | Critical | 9.8 | 2022-11-22 | In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, w… |
CVE-2022-44641 | Medium | 6.5 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML e… |
CVE-2022-41916 | Medium | 5.9 | 2022-11-15 | Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI cer… |
CVE-2022-3970 | Medium | 6.3 | 2022-11-13 | A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The… |
CVE-2022-45188 | High | 7.8 | 2022-11-12 | Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file. This provides remote root access on… |
CVE-2022-45062 | Critical | 9.8 | 2022-11-09 | In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper. |
CVE-2022-45060 | High | 7.5 | 2022-11-09 | An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce ch… |
CVE-2022-3890 | Critical | 9.6 | 2022-11-09 | Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to pote… |
CVE-2022-3889 | High | 8.8 | 2022-11-09 | Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2022-3888 | High | 8.8 | 2022-11-09 | Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-3887 | High | 8.8 | 2022-11-09 | Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-3886 | High | 8.8 | 2022-11-09 | Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2022-3885 | High | 8.8 | 2022-11-09 | Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2022-39377 | High | 7.0 | 2022-11-08 | sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_stru… |
CVE-2022-44793 | Medium | 6.5 | 2022-11-07 | handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote att… |
CVE-2022-44792 | Medium | 6.5 | 2022-11-07 | handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker… |
CVE-2022-40284 | High | 7.8 | 2022-11-06 | A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if… |
CVE-2021-34055 | High | 7.8 | 2022-11-04 | jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u. |
CVE-2022-44638 | High | 8.8 | 2022-11-03 | In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixma… |
CVE-2022-39353 | Critical | 9.4 | 2022-11-02 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because… |
CVE-2022-43253 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability al… |
CVE-2022-43252 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerability allows attack… |
CVE-2022-43250 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows at… |
CVE-2022-43249 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerabili… |
CVE-2022-43248 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability… |
CVE-2022-43245 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cau… |
CVE-2022-43244 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability… |
CVE-2022-43243 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability all… |
CVE-2022-43242 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc. This vulnerability allows attackers to… |
CVE-2022-43241 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a… |
CVE-2022-43240 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allow… |
CVE-2022-43239 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerability allows attackers… |
CVE-2022-43238 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause… |
CVE-2022-43237 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulne… |
CVE-2022-43236 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability… |
CVE-2022-43235 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allo… |
CVE-2021-37789 | High | 8.1 | 2022-11-02 | stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service. |
CVE-2022-42824 | Medium | 5.5 | 2022-11-01 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 1… |
CVE-2022-42823 | High | 8.8 | 2022-11-01 | A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and… |
CVE-2022-42799 | Medium | 6.1 | 2022-11-01 | The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiti… |
CVE-2022-42326 | Medium | 5.5 | 2022-11-01 | Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/v… |
CVE-2022-42325 | Medium | 5.5 | 2022-11-01 | Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/v… |
CVE-2022-42324 | Medium | 5.5 | 2022-11-01 | Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the… |
CVE-2022-42323 | Medium | 5.5 | 2022-11-01 | Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulne… |
CVE-2022-42322 | Medium | 5.5 | 2022-11-01 | Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulne… |
CVE-2022-42321 | Medium | 6.5 | 2022-11-01 | Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xensto… |
CVE-2022-42320 | High | 7.0 | 2022-11-01 | Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenst… |
CVE-2022-42319 | Medium | 6.5 | 2022-11-01 | Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of… |
CVE-2022-42318 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42317 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42316 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42315 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42314 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42313 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42312 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42311 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42310 | Medium | 5.5 | 2022-11-01 | Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphane… |
CVE-2022-42309 | High | 8.8 | 2022-11-01 | Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an… |
CVE-2022-40617 | High | 7.5 | 2022-10-31 | strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) cer… |
CVE-2022-41974 | High | 7.8 | 2022-10-29 | multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local user… |
CVE-2022-41973 | High | 7.8 | 2022-10-29 | multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to… |
CVE-2022-3705 | Medium | 5.0 | 2022-10-26 | A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component… |
CVE-2022-39348 | Medium | 5.4 | 2022-10-26 | Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.v… |
CVE-2022-39286 | High | 8.8 | 2022-10-26 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vuln… |
CVE-2022-43750 | Medium | 6.7 | 2022-10-26 | drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. |
CVE-2022-42890 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics p… |
CVE-2022-41704 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16… |
CVE-2022-43680 | High | 7.5 | 2022-10-24 | In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situati… |
CVE-2021-46848 | Critical | 9.1 | 2022-10-24 | GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. |
CVE-2022-3649 | Low | 3.1 | 2022-10-21 | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the… |
CVE-2022-3646 | Low | 3.1 | 2022-10-21 | A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/ni… |
CVE-2022-3627 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attacke… |
CVE-2022-3626 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attac… |
CVE-2022-3599 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file… |
CVE-2022-3598 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a c… |
CVE-2022-3597 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attacke… |
CVE-2022-3570 | High | 7.7 | 2022-10-21 | Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via craf… |
CVE-2022-3640 | Medium | 5.5 | 2022-10-21 | A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of… |