Debian
Page 23 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31030 | Medium | 5.5 | 2022-06-09 | containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containe… |
CVE-2019-9972 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesyste… |
CVE-2019-9971 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump comm… |
CVE-2022-32250 | High | 7.8 | 2022-06-02 | net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root becaus… |
CVE-2022-31799 | Critical | 9.8 | 2022-06-02 | Bottle before 0.12.20 mishandles errors during early request binding. |
CVE-2022-27782 | High | 7.5 | 2022-06-02 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previ… |
CVE-2022-27781 | High | 7.5 | 2022-06-02 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous fu… |
CVE-2022-27776 | Medium | 6.5 | 2022-06-02 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host… |
CVE-2022-27775 | High | 7.5 | 2022-06-02 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a… |
CVE-2022-27774 | Medium | 5.7 | 2022-06-02 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract creden… |
CVE-2022-26491 | Medium | 5.9 | 2022-06-02 | An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The clie… |
CVE-2022-1968 | High | 7.8 | 2022-06-02 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-1789 | Medium | 6.8 | 2022-06-02 | With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not… |
CVE-2022-1652 | High | 7.8 | 2022-06-02 | Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By… |
CVE-2022-1462 | Medium | 6.3 | 2022-06-02 | An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK… |
CVE-2022-1419 | High | 7.8 | 2022-06-02 | The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_cr… |
CVE-2022-31003 | Critical | 9.1 | 2022-05-31 | Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = rec… |
CVE-2022-31001 | High | 7.5 | 2022-05-31 | Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to Free… |
CVE-2022-31002 | High | 7.5 | 2022-05-31 | Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to Free… |
CVE-2022-1942 | High | 7.8 | 2022-05-31 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-1897 | High | 7.8 | 2022-05-27 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-1898 | High | 7.8 | 2022-05-27 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-26691 | Medium | 6.7 | 2022-05-26 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5… |
CVE-2022-27777 | Medium | 6.1 | 2022-05-26 | A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attr… |
CVE-2022-22577 | Medium | 6.1 | 2022-05-26 | An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses. |
CVE-2022-22576 | High | 8.1 | 2022-05-26 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properl… |
CVE-2022-21831 | Critical | 9.8 | 2022-05-26 | A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments. |
CVE-2022-30789 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22. |
CVE-2022-30788 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22. |
CVE-2022-30787 | Medium | 6.7 | 2022-05-26 | An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite. |
CVE-2022-30786 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22. |
CVE-2022-30785 | Medium | 6.7 | 2022-05-26 | A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22… |
CVE-2022-30784 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22. |
CVE-2022-30783 | Medium | 6.7 | 2022-05-26 | An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 whe… |
CVE-2022-1664 | Critical | 9.8 | 2022-05-26 | Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerab… |
CVE-2022-29248 | High | 8.0 | 2022-05-25 | Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not… |
CVE-2022-1851 | High | 7.8 | 2022-05-25 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-29221 | High | 8.8 | 2022-05-24 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, templat… |
CVE-2022-29599 | Critical | 9.8 | 2022-05-23 | In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injecti… |
CVE-2022-1785 | High | 7.8 | 2022-05-19 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977. |
CVE-2022-1734 | High | 7.0 | 2022-05-18 | A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized… |
CVE-2022-30975 | Medium | 5.5 | 2022-05-18 | In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp. |
CVE-2022-30974 | Medium | 5.5 | 2022-05-18 | compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413. |
CVE-2022-30688 | High | 7.8 | 2022-05-17 | needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allo… |
CVE-2022-29581 | High | 7.8 | 2022-05-17 | Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects… |
CVE-2022-1586 | Critical | 9.1 | 2022-05-16 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This inv… |
CVE-2022-1679 | High | 7.8 | 2022-05-16 | A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail w… |
CVE-2022-21151 | Medium | 5.5 | 2022-05-12 | Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable inf… |
CVE-2022-1650 | High | 8.1 | 2022-05-12 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. |
CVE-2022-29885 | High | 7.5 | 2022-05-12 | The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly… |
CVE-2022-30594 | High | 7.8 | 2022-05-12 | The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SU… |
CVE-2022-1623 | Medium | 5.5 | 2022-05-11 | LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file… |
CVE-2022-1621 | High | 7.8 | 2022-05-10 | Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protec… |
CVE-2022-28739 | High | 7.5 | 2022-05-09 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, inclu… |
CVE-2022-27114 | Medium | 5.5 | 2022-05-09 | There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they are large enough to… |
CVE-2022-30333 | High | 7.5 | 2022-05-09 | RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a… |
CVE-2022-28463 | High | 7.8 | 2022-05-08 | ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. |
CVE-2022-1619 | High | 7.8 | 2022-05-08 | Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing softwar… |
CVE-2018-25033 | High | 8.1 | 2022-05-08 | ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a. |
CVE-2022-1616 | High | 7.8 | 2022-05-07 | Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanis… |
CVE-2022-30293 | High | 7.5 | 2022-05-06 | In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphi… |
CVE-2022-24903 | High | 8.1 | 2022-05-06 | Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used… |
CVE-2022-24884 | Critical | 10.0 | 2022-05-06 | ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature value… |
CVE-2022-27337 | Medium | 6.5 | 2022-05-05 | A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. |
CVE-2022-29501 | High | 8.8 | 2022-05-05 | SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution. |
CVE-2022-29500 | High | 8.8 | 2022-05-05 | SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure. |
CVE-2022-1516 | Medium | 5.5 | 2022-05-05 | A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their ses… |
CVE-2022-29155 | Critical | 9.8 | 2022-05-04 | In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement w… |
CVE-2022-20796 | Medium | 6.5 | 2022-05-04 | On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability… |
CVE-2022-20785 | High | 7.5 | 2022-05-04 | On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerabili… |
CVE-2022-20771 | High | 7.5 | 2022-05-04 | On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerabili… |
CVE-2022-20770 | High | 8.6 | 2022-05-04 | On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerabili… |
CVE-2022-1292 | High | 7.3 | 2022-05-03 | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a man… |
CVE-2022-29824 | Medium | 6.5 | 2022-05-03 | In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in ou… |
CVE-2021-42532 | High | 7.8 | 2022-05-02 | XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in t… |
CVE-2021-42531 | High | 7.8 | 2022-05-02 | XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in t… |
CVE-2021-42530 | High | 7.8 | 2022-05-02 | XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in t… |
CVE-2021-42529 | High | 7.8 | 2022-05-02 | XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in t… |
CVE-2021-42528 | Medium | 5.5 | 2022-05-02 | XMP Toolkit 2021.07 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker co… |
CVE-2021-46790 | High | 7.8 | 2022-05-02 | ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; howeve… |
CVE-2022-29970 | High | 7.5 | 2022-05-02 | Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. |
CVE-2022-25647 | High | 7.7 | 2022-05-01 | The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which… |
CVE-2021-4207 | High | 8.2 | 2022-04-29 | A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can… |
CVE-2021-4206 | High | 8.2 | 2022-04-29 | A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor o… |
CVE-2022-1353 | High | 7.1 | 2022-04-29 | A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to… |
CVE-2022-1195 | Medium | 5.5 | 2022-04-29 | A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial… |
CVE-2022-1048 | High | 7.0 | 2022-04-29 | A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or simil… |
CVE-2022-29869 | Medium | 5.3 | 2022-04-28 | cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. |
CVE-2022-27239 | High | 7.8 | 2022-04-27 | In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root priv… |
CVE-2022-1441 | High | 7.8 | 2022-04-25 | MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `di… |
CVE-2022-24792 | High | 7.5 | 2022-04-25 | PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that… |
CVE-2019-25059 | High | 7.8 | 2022-04-25 | Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. |
CVE-2022-29582 | High | 7.0 | 2022-04-22 | In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who h… |
CVE-2022-29536 | High | 7.5 | 2022-04-20 | In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long… |
CVE-2022-21496 | Medium | 5.3 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Or… |
CVE-2022-21476 | High | 7.5 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21449 | High | 7.5 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21443 | Low | 3.7 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21434 | Medium | 5.3 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21427 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and pr… |