Debian
Page 20 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3636 | Medium | 5.5 | 2022-10-21 | A vulnerability was identified in Linux Kernel 33fc42de33278b2b3ec6f3390512987bc29a62b7. This affects the function __mtk_ppe_check_skb of the file drivers/net/… |
CVE-2022-3635 | Medium | 5.5 | 2022-10-21 | A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt… |
CVE-2022-3633 | Low | 3.5 | 2022-10-21 | A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c… |
CVE-2022-3629 | Low | 2.6 | 2022-10-21 | A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock… |
CVE-2022-3625 | Medium | 4.6 | 2022-10-21 | A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/co… |
CVE-2022-37454 | Critical | 9.8 | 2022-10-21 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary… |
CVE-2022-3623 | Medium | 5.0 | 2022-10-20 | A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/g… |
CVE-2022-3621 | Medium | 4.3 | 2022-10-20 | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/ino… |
CVE-2022-41742 | High | 7.1 | 2022-10-19 | NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and… |
CVE-2022-41741 | High | 7.0 | 2022-10-19 | NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and… |
CVE-2022-3586 | Medium | 5.5 | 2022-10-19 | A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb fiel… |
CVE-2022-39260 | High | 8.5 | 2022-10-19 | Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull fun… |
CVE-2022-39253 | Medium | 5.5 | 2022-10-19 | Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are… |
CVE-2022-3594 | Medium | 5.3 | 2022-10-18 | A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file driver… |
CVE-2022-3517 | High | 7.5 | 2022-10-17 | A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with… |
CVE-2022-3564 | Medium | 5.5 | 2022-10-17 | A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth… |
CVE-2022-41751 | High | 7.8 | 2022-10-17 | Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option. |
CVE-2022-3551 | Low | 3.5 | 2022-10-17 | A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xk… |
CVE-2022-3550 | Medium | 5.5 | 2022-10-17 | A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The m… |
CVE-2022-3545 | Medium | 5.5 | 2022-10-17 | A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/ne… |
CVE-2022-3524 | Medium | 4.3 | 2022-10-16 | A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the compon… |
CVE-2022-3521 | Low | 2.6 | 2022-10-16 | A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c… |
CVE-2022-2850 | Medium | 6.5 | 2022-10-14 | A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a special… |
CVE-2022-42722 | Medium | 5.5 | 2022-10-14 | In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereferenc… |
CVE-2022-42721 | Medium | 5.5 | 2022-10-14 | A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inj… |
CVE-2022-42720 | High | 7.8 | 2022-10-14 | Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers… |
CVE-2022-41674 | High | 8.1 | 2022-10-14 | An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update… |
CVE-2022-42719 | High | 8.8 | 2022-10-13 | A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (abl… |
CVE-2022-42906 | High | 7.8 | 2022-10-13 | powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that chan… |
CVE-2022-42902 | High | 8.8 | 2022-10-13 | In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitizat… |
CVE-2021-36369 | High | 7.5 | 2022-10-12 | An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it i… |
CVE-2022-37601 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all vers… |
CVE-2022-41404 | High | 7.5 | 2022-10-11 | An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecifie… |
CVE-2022-3140 | Medium | 6.3 | 2022-10-11 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command'… |
CVE-2022-20422 | High | 7.0 | 2022-10-11 | In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of priv… |
CVE-2022-20421 | High | 7.8 | 2022-10-11 | In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege wit… |
CVE-2022-33748 | Medium | 5.6 | 2022-10-11 | lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, lockin… |
CVE-2022-33747 | Low | 3.8 | 2022-10-11 | Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When… |
CVE-2022-33746 | Medium | 6.5 | 2022-10-11 | P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing m… |
CVE-2022-37616 | Critical | 9.8 | 2022-10-11 | A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the… |
CVE-2022-3435 | Medium | 4.3 | 2022-10-08 | A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the co… |
CVE-2022-2929 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels long… |
CVE-2022-2928 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the op… |
CVE-2022-41853 | High | 8.0 | 2022-10-06 | Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execut… |
CVE-2022-42004 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent us… |
CVE-2022-42003 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserialize… |
CVE-2022-41850 | Medium | 4.7 | 2022-09-30 | roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations whe… |
CVE-2022-41849 | Medium | 4.2 | 2022-09-30 | drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes… |
CVE-2022-3352 | High | 7.8 | 2022-09-29 | Use After Free in GitHub repository vim/vim prior to 9.0.0614. |
CVE-2016-2338 | Critical | 9.8 | 2022-09-29 | An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer… |
CVE-2022-31629 | Medium | 6.5 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's b… |
CVE-2022-31628 | Low | 2.3 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. |
CVE-2022-1270 | High | 7.8 | 2022-09-28 | In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. |
CVE-2022-39261 | High | 7.5 | 2022-09-28 | Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader lo… |
CVE-2021-43980 | Low | 3.7 | 2022-09-28 | The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extrem… |
CVE-2022-32166 | Medium | 6.1 | 2022-09-28 | In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an… |
CVE-2022-3324 | High | 7.8 | 2022-09-27 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. |
CVE-2022-3303 | Medium | 4.7 | 2022-09-27 | A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SND… |
CVE-2022-3201 | Medium | 5.4 | 2022-09-26 | Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to instal… |
CVE-2022-21797 | High | 7.3 | 2022-09-26 | The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. |
CVE-2022-40188 | High | 7.5 | 2022-09-23 | Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an autho… |
CVE-2022-35252 | Low | 3.7 | 2022-09-23 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver migh… |
CVE-2022-40146 | High | 7.5 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache… |
CVE-2022-38648 | Medium | 5.3 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML… |
CVE-2022-38398 | Medium | 5.3 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apa… |
CVE-2022-1941 | High | 7.5 | 2022-09-22 | A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for pr… |
CVE-2022-3256 | High | 7.8 | 2022-09-22 | Use After Free in GitHub repository vim/vim prior to 9.0.0530. |
CVE-2022-38178 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-38177 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-2795 | Medium | 5.3 | 2022-09-21 | By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitima… |
CVE-2022-41222 | High | 7.0 | 2022-09-21 | mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. |
CVE-2022-41218 | Medium | 5.5 | 2022-09-21 | In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dm… |
CVE-2022-32886 | High | 8.8 | 2022-09-20 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously… |
CVE-2017-20148 | Critical | 9.8 | 2022-09-20 | In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because… |
CVE-2022-39958 | High | 7.5 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedl… |
CVE-2022-39957 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset… |
CVE-2022-39956 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character en… |
CVE-2022-39955 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indica… |
CVE-2022-37032 | Critical | 9.1 | 2022-09-19 | An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_p… |
CVE-2022-28203 | High | 7.5 | 2022-09-19 | A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special… |
CVE-2022-28201 | Medium | 4.4 | 2022-09-19 | An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinit… |
CVE-2022-3235 | High | 7.8 | 2022-09-18 | Use After Free in GitHub repository vim/vim prior to 9.0.0490. |
CVE-2022-40768 | Medium | 5.5 | 2022-09-18 | drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lack… |
CVE-2022-3234 | High | 7.8 | 2022-09-17 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. |
CVE-2022-3176 | High | 7.8 | 2022-09-16 | There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will se… |
CVE-2022-40150 | Medium | 6.5 | 2022-09-16 | Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2022-40149 | Medium | 6.5 | 2022-09-16 | Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2022-38851 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function read_meta_record() of mplayer/libmpdemux/asfheader.c. This affects mplay… |
CVE-2022-38850 | Medium | 5.5 | 2022-09-15 | The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c. |
CVE-2022-38866 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer SVN-r38374-13.0.1… |
CVE-2022-38865 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This affects mplyer SVN… |
CVE-2022-38864 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects mencoder SVN-r38… |
CVE-2022-38863 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mp_getbits() of libmpdemux/mpeg_hdr.c which affects mencoder and mplayer. T… |
CVE-2022-38861 | Medium | 5.5 | 2022-09-15 | The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_mp_image() of libmpcodecs/mp_image.c. |
CVE-2022-38860 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder. This affe… |
CVE-2022-38858 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r3837… |
CVE-2022-38855 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function gen_sh_video () of mplayer/libmpdemux/demux_mov.c. This affects mplayer SVN… |
CVE-2018-25047 | Medium | 5.4 | 2022-09-15 | In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be param… |
CVE-2022-40674 | High | 8.1 | 2022-09-14 | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. |
CVE-2022-37797 | High | 7.5 | 2022-09-12 | In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null… |