Debian
Page 21 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38266 | Medium | 6.5 | 2022-09-09 | An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG fi… |
CVE-2022-3169 | Medium | 5.5 | 2022-09-09 | A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RE… |
CVE-2022-36280 | Medium | 6.3 | 2022-09-09 | An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with devic… |
CVE-2022-2905 | Medium | 5.5 | 2022-09-09 | An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_e… |
CVE-2022-40307 | Medium | 4.7 | 2022-09-09 | An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free. |
CVE-2022-40023 | High | 7.5 | 2022-09-07 | Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and lingu… |
CVE-2022-3134 | High | 7.8 | 2022-09-06 | Use After Free in GitHub repository vim/vim prior to 9.0.0389. |
CVE-2022-2735 | High | 7.8 | 2022-09-06 | A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemo… |
CVE-2022-38751 | Medium | 6.5 | 2022-09-05 | Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacke… |
CVE-2022-38750 | Medium | 6.5 | 2022-09-05 | Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacke… |
CVE-2022-38749 | Medium | 6.5 | 2022-09-05 | Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacke… |
CVE-2022-3008 | High | 8.1 | 2022-09-05 | The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This functi… |
CVE-2022-39842 | Medium | 6.1 | 2022-09-05 | An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of si… |
CVE-2022-3099 | High | 7.8 | 2022-09-03 | Use After Free in GitHub repository vim/vim prior to 9.0.0360. |
CVE-2020-29260 | High | 7.5 | 2022-09-02 | libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup(). |
CVE-2020-22669 | Critical | 9.8 | 2022-09-02 | Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable… |
CVE-2022-39190 | Medium | 5.5 | 2022-09-02 | An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chai… |
CVE-2022-39188 | Medium | 4.7 | 2022-09-02 | An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device… |
CVE-2022-39177 | High | 8.8 | 2022-09-02 | BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/au… |
CVE-2022-39176 | High | 8.8 | 2022-09-02 | BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len. |
CVE-2022-2663 | Medium | 5.3 | 2022-09-01 | An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be ab… |
CVE-2022-3061 | Medium | 5.5 | 2022-09-01 | Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the v… |
CVE-2022-2996 | High | 7.4 | 2022-09-01 | A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up… |
CVE-2020-35533 | Medium | 5.5 | 2022-09-01 | In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the… |
CVE-2020-35532 | Medium | 5.5 | 2022-09-01 | In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered v… |
CVE-2020-35531 | Medium | 5.5 | 2022-09-01 | In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an i… |
CVE-2020-35530 | Medium | 5.5 | 2022-09-01 | In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a cr… |
CVE-2022-3028 | High | 7.0 | 2022-08-31 | A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simulta… |
CVE-2022-2521 | Medium | 6.5 | 2022-08-31 | It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a p… |
CVE-2022-2520 | Medium | 6.5 | 2022-08-31 | A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a craft… |
CVE-2022-2519 | Medium | 6.5 | 2022-08-31 | There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 |
CVE-2022-2153 | Medium | 5.5 | 2022-08-31 | A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs… |
CVE-2022-2132 | High | 8.6 | 2022-08-31 | A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vho… |
CVE-2022-1355 | Medium | 6.1 | 2022-08-31 | A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, t… |
CVE-2022-1354 | Medium | 5.5 | 2022-08-31 | A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to… |
CVE-2022-1271 | High | 8.8 | 2022-08-31 | An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted f… |
CVE-2021-46837 | Medium | 6.5 | 2022-08-30 | res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker… |
CVE-2022-39028 | High | 7.5 | 2022-08-30 | telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical… |
CVE-2022-25857 | High | 7.5 | 2022-08-30 | The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. |
CVE-2022-38784 | High | 7.8 | 2022-08-30 | Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a spec… |
CVE-2022-2953 | Medium | 5.5 | 2022-08-29 | LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff fil… |
CVE-2022-1204 | Medium | 5.5 | 2022-08-29 | A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows… |
CVE-2022-1184 | Medium | 5.5 | 2022-08-29 | A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a u… |
CVE-2022-0718 | Medium | 4.9 | 2022-08-29 | A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any… |
CVE-2022-0367 | High | 7.8 | 2022-08-29 | A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c. |
CVE-2022-2787 | Medium | 4.3 | 2022-08-27 | Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a s… |
CVE-2022-0171 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kerne… |
CVE-2021-3864 | High | 7.0 | 2022-08-26 | A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that s… |
CVE-2021-3735 | Medium | 4.4 | 2022-08-26 | A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS… |
CVE-2021-3669 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource… |
CVE-2021-3563 | High | 7.4 | 2022-08-26 | A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity w… |
CVE-2022-2255 | High | 7.5 | 2022-08-25 | A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-… |
CVE-2022-0135 | High | 7.8 | 2022-08-25 | An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted v… |
CVE-2022-22728 | High | 7.5 | 2022-08-25 | A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a requ… |
CVE-2022-32893 | High | 8.8 | 2022-08-24 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15… |
CVE-2022-2978 | High | 7.8 | 2022-08-24 | A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to fun… |
CVE-2021-4214 | Medium | 5.5 | 2022-08-24 | A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to t… |
CVE-2021-4213 | High | 7.5 | 2022-08-24 | A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM… |
CVE-2021-4204 | High | 7.1 | 2022-08-24 | An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a sp… |
CVE-2021-4189 | Medium | 5.3 | 2022-08-24 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the… |
CVE-2021-4159 | Medium | 4.4 | 2022-08-24 | A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace… |
CVE-2021-4037 | Medium | 4.4 | 2022-08-24 | A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-syst… |
CVE-2021-3999 | High | 7.8 | 2022-08-24 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A lo… |
CVE-2022-31676 | High | 7.8 | 2022-08-23 | VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Gue… |
CVE-2021-3975 | Medium | 6.5 | 2022-08-23 | A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being… |
CVE-2020-35511 | High | 7.8 | 2022-08-23 | A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file. |
CVE-2022-2946 | High | 7.8 | 2022-08-23 | Use After Free in GitHub repository vim/vim prior to 9.0.0246. |
CVE-2021-3800 | Medium | 5.5 | 2022-08-23 | A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones… |
CVE-2021-3759 | Medium | 5.5 | 2022-08-23 | A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple… |
CVE-2021-31566 | High | 7.8 | 2022-08-23 | An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of t… |
CVE-2021-23177 | High | 7.8 | 2022-08-23 | An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may prov… |
CVE-2021-20316 | Medium | 6.8 | 2022-08-23 | A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata… |
CVE-2021-20298 | High | 7.5 | 2022-08-23 | A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory acces… |
CVE-2022-2873 | Medium | 5.5 | 2022-08-22 | An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA… |
CVE-2020-27792 | High | 7.1 | 2022-08-19 | A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to tri… |
CVE-2022-26373 | Medium | 5.5 | 2022-08-18 | Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information… |
CVE-2021-32862 | High | 7.5 | 2022-08-18 | The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version… |
CVE-2022-2869 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies… |
CVE-2022-2868 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supp… |
CVE-2022-2867 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely… |
CVE-2020-21365 | High | 7.5 | 2022-08-15 | Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted ht… |
CVE-2022-20369 | Medium | 6.7 | 2022-08-11 | In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privil… |
CVE-2022-31780 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Tra… |
CVE-2022-31779 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Tra… |
CVE-2022-31778 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue af… |
CVE-2022-28129 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apac… |
CVE-2022-25763 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. Thi… |
CVE-2021-37150 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Tr… |
CVE-2022-37452 | Critical | 9.8 | 2022-08-07 | Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. |
CVE-2022-37434 | Critical | 9.8 | 2022-08-05 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications t… |
CVE-2022-31197 | High | 7.1 | 2022-08-03 | PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC i… |
CVE-2022-36359 | High | 8.8 | 2022-08-03 | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file downl… |
CVE-2022-32293 | High | 8.1 | 2022-08-03 | In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes… |
CVE-2022-32292 | Critical | 9.8 | 2022-08-03 | In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to… |
CVE-2022-2598 | Medium | 6.5 | 2022-08-01 | Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100. |
CVE-2022-2509 | High | 7.5 | 2022-08-01 | A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verif… |
CVE-2022-34526 | Medium | 6.5 | 2022-07-29 | A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via… |
CVE-2022-30287 | High | 8.0 | 2022-07-28 | Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads t… |
CVE-2022-2553 | Medium | 6.5 | 2022-07-28 | The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do no… |
CVE-2022-36946 | High | 7.5 | 2022-07-27 | nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in th… |