Debian
Page 25 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3582 | Medium | 6.5 | 2022-03-25 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improp… |
CVE-2018-25032 | High | 7.5 | 2022-03-25 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. |
CVE-2022-24769 | Medium | 5.9 | 2022-03-24 | Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 2… |
CVE-2021-43666 | High | 7.5 | 2022-03-24 | A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0. |
CVE-2022-0854 | Medium | 5.5 | 2022-03-23 | A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory… |
CVE-2021-4197 | High | 7.8 | 2022-03-23 | An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some les… |
CVE-2021-4156 | High | 7.1 | 2022-03-23 | An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user… |
CVE-2021-4149 | Medium | 5.5 | 2022-03-23 | A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user… |
CVE-2021-3748 | High | 7.5 | 2022-03-23 | A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region… |
CVE-2021-3618 | High | 7.4 | 2022-03-23 | ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, su… |
CVE-2021-44759 | High | 8.1 | 2022-03-23 | Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue aff… |
CVE-2021-44040 | High | 7.5 | 2022-03-23 | Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache… |
CVE-2022-27666 | High | 7.8 | 2022-03-23 | A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal… |
CVE-2022-24764 | High | 7.5 | 2022-03-22 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affec… |
CVE-2022-1011 | High | 7.8 | 2022-03-18 | A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized ac… |
CVE-2022-0547 | Critical | 9.8 | 2022-03-18 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred auth… |
CVE-2022-24302 | Medium | 5.9 | 2022-03-17 | In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
CVE-2022-24761 | High | 7.5 | 2022-03-17 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly valida… |
CVE-2022-26354 | Low | 3.2 | 2022-03-16 | A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading… |
CVE-2022-26353 | High | 7.5 | 2022-03-16 | A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virt… |
CVE-2021-39713 | High | 7.0 | 2022-03-16 | Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel |
CVE-2021-20299 | High | 7.5 | 2022-03-16 | A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference… |
CVE-2021-20257 | Medium | 6.5 | 2022-03-16 | An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if vari… |
CVE-2022-27223 | High | 8.8 | 2022-03-16 | In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-… |
CVE-2022-0778 | High | 7.5 | 2022-03-15 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this functi… |
CVE-2021-43305 | High | 8.8 | 2022-03-14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decomp… |
CVE-2021-43304 | High | 8.8 | 2022-03-14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decomp… |
CVE-2021-42388 | High | 8.1 | 2022-03-14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user… |
CVE-2021-42387 | High | 8.1 | 2022-03-14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user… |
CVE-2022-0943 | High | 7.8 | 2022-03-14 | Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563. |
CVE-2022-20001 | High | 7.8 | 2022-03-14 | fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository c… |
CVE-2022-23943 | Critical | 9.8 | 2022-03-14 | Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue… |
CVE-2022-22721 | Critical | 9.1 | 2022-03-14 | If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out o… |
CVE-2022-22720 | Critical | 9.8 | 2022-03-14 | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Re… |
CVE-2022-22719 | High | 7.5 | 2022-03-14 | A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52… |
CVE-2022-23960 | Medium | 5.6 | 2022-03-13 | Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared… |
CVE-2021-36368 | Low | 3.7 | 2022-03-13 | An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an atta… |
CVE-2022-26966 | Medium | 5.5 | 2022-03-12 | An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via craf… |
CVE-2022-24754 | High | 8.5 | 2022-03-11 | PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer o… |
CVE-2022-0924 | Medium | 5.5 | 2022-03-11 | Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from… |
CVE-2022-0909 | Medium | 5.5 | 2022-03-11 | Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-0908 | High | 7.7 | 2022-03-11 | Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Deni… |
CVE-2022-0907 | Medium | 5.5 | 2022-03-11 | Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2022-26874 | Medium | 5.4 | 2022-03-11 | lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail E… |
CVE-2020-36518 | High | 7.5 | 2022-03-11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. |
CVE-2022-23042 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23041 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23040 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23039 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23038 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23037 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23036 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-26847 | Medium | 5.3 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. |
CVE-2022-26846 | High | 8.8 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code. |
CVE-2022-26662 | High | 7.5 | 2022-03-10 | An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through… |
CVE-2022-26661 | Medium | 6.5 | 2022-03-10 | An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Appli… |
CVE-2022-26520 | Critical | 9.8 | 2022-03-10 | In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the l… |
CVE-2022-0891 | Medium | 6.1 | 2022-03-10 | A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory… |
CVE-2022-0865 | Medium | 5.5 | 2022-03-10 | Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sourc… |
CVE-2022-0516 | High | 7.8 | 2022-03-10 | A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local atta… |
CVE-2022-0204 | High | 8.8 | 2022-03-10 | A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an… |
CVE-2021-33293 | Critical | 9.1 | 2022-03-10 | Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c. |
CVE-2021-32436 | Medium | 6.5 | 2022-03-10 | An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified ve… |
CVE-2021-32435 | Medium | 5.5 | 2022-03-10 | Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified v… |
CVE-2021-32434 | Medium | 5.5 | 2022-03-10 | abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c. |
CVE-2022-24919 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only… |
CVE-2022-24917 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed onl… |
CVE-2022-24349 | Medium | 4.6 | 2022-03-09 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same ob… |
CVE-2022-24713 | High | 7.5 | 2022-03-08 | regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks cau… |
CVE-2022-26505 | High | 7.4 | 2022-03-06 | A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files. |
CVE-2022-26496 | Critical | 9.8 | 2022-03-06 | In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a… |
CVE-2022-26495 | Critical | 9.8 | 2022-03-06 | In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will… |
CVE-2022-26490 | High | 7.8 | 2022-03-06 | st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted… |
CVE-2022-24921 | High | 7.5 | 2022-03-05 | regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. |
CVE-2021-20303 | Medium | 6.1 | 2022-03-04 | A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trig… |
CVE-2021-20302 | Medium | 5.5 | 2022-03-04 | A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by Open… |
CVE-2021-20300 | Medium | 5.5 | 2022-03-04 | A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is proc… |
CVE-2021-3744 | Medium | 5.5 | 2022-03-04 | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denia… |
CVE-2022-0730 | Critical | 9.8 | 2022-03-03 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. |
CVE-2021-3640 | High | 7.0 | 2022-03-03 | A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way trigge… |
CVE-2021-4002 | Medium | 4.4 | 2022-03-03 | A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligne… |
CVE-2022-21716 | High | 7.5 | 2022-03-03 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to acce… |
CVE-2022-0492 | High | 7.8 | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, a… |
CVE-2022-23648 | High | 7.5 | 2022-03-03 | containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where… |
CVE-2021-3772 | Medium | 6.5 | 2022-03-02 | A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP… |
CVE-2021-3667 | Medium | 6.5 | 2022-03-02 | An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a loc… |
CVE-2022-0711 | High | 7.5 | 2022-03-02 | A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP respon… |
CVE-2022-0577 | Medium | 6.5 | 2022-03-02 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. |
CVE-2022-24720 | Critical | 9.8 | 2022-03-01 | image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_proce… |
CVE-2022-23308 | High | 7.5 | 2022-02-26 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. |
CVE-2022-21824 | High | 8.2 | 2022-02-24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while s… |
CVE-2022-0546 | High | 7.8 | 2022-02-24 | A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service… |
CVE-2022-0545 | High | 7.8 | 2022-02-24 | An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attack… |
CVE-2022-0544 | Medium | 5.5 | 2022-02-24 | An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS imag… |
CVE-2021-44533 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subj… |
CVE-2021-44532 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certifica… |
CVE-2021-3700 | Medium | 6.4 | 2022-02-24 | A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This iss… |
CVE-2021-3608 | Medium | 6.0 | 2022-02-24 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHI… |
CVE-2021-3607 | Medium | 6.0 | 2022-02-24 | An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVR… |
CVE-2021-3596 | Medium | 6.5 | 2022-02-24 | A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking th… |