Debian
Page 30 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42771 | High | 7.8 | 2021-10-20 | Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading… |
CVE-2021-42762 | Medium | 5.3 | 2021-10-20 | BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into t… |
CVE-2021-35603 | Low | 3.7 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE… |
CVE-2021-35588 | Low | 3.1 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java S… |
CVE-2021-35586 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java S… |
CVE-2021-35578 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE… |
CVE-2021-35567 | Medium | 6.8 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java… |
CVE-2021-35565 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE… |
CVE-2021-35564 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java S… |
CVE-2021-35561 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java S… |
CVE-2021-35559 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE… |
CVE-2021-35556 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE… |
CVE-2021-35550 | Medium | 5.9 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE… |
CVE-2021-42739 | Medium | 6.7 | 2021-10-20 | The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/fir… |
CVE-2021-37137 | High | 7.5 | 2021-10-19 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable… |
CVE-2021-37136 | High | 7.5 | 2021-10-19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during… |
CVE-2021-30846 | High | 7.8 | 2021-10-19 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 1… |
CVE-2021-3872 | High | 7.8 | 2021-10-19 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-41991 | High | 7.5 | 2021-10-18 | The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the c… |
CVE-2021-41990 | High | 7.5 | 2021-10-18 | The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be trigge… |
CVE-2021-38562 | High | 7.5 | 2021-10-18 | Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack again… |
CVE-2021-28021 | High | 7.8 | 2021-10-15 | Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. |
CVE-2021-42340 | High | 7.5 | 2021-10-14 | The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. Th… |
CVE-2021-40732 | Medium | 6.1 | 2021-10-13 | XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer dereference vulnerability that could result in leaking data from certain memory location… |
CVE-2021-42326 | Medium | 5.3 | 2021-10-12 | Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter. |
CVE-2021-3671 | Medium | 6.5 | 2021-10-12 | A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated us… |
CVE-2021-41136 | Low | 3.7 | 2021-10-12 | Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which cont… |
CVE-2021-25634 | High | 7.5 | 2021-10-12 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2021-42260 | High | 7.5 | 2021-10-11 | TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML… |
CVE-2021-25633 | High | 7.5 | 2021-10-11 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2021-37976 | Medium | 6.5 | 2021-10-08 | Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2021-37975 | High | 8.8 | 2021-10-08 | Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37974 | High | 8.8 | 2021-10-08 | Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2021-37973 | Critical | 9.6 | 2021-10-08 | Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2021-37972 | High | 8.8 | 2021-10-08 | Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-37971 | Medium | 4.3 | 2021-10-08 | Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2021-37970 | High | 8.8 | 2021-10-08 | Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-37969 | High | 7.8 | 2021-10-08 | Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalatio… |
CVE-2021-37968 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-37967 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process… |
CVE-2021-37966 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2021-37965 | Medium | 4.3 | 2021-10-08 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-37964 | Low | 3.3 | 2021-10-08 | Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point t… |
CVE-2021-37963 | Medium | 4.3 | 2021-10-08 | Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2021-37962 | High | 8.8 | 2021-10-08 | Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2021-37961 | High | 8.8 | 2021-10-08 | Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37959 | High | 8.8 | 2021-10-08 | Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potenti… |
CVE-2021-37958 | Medium | 5.4 | 2021-10-08 | Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privile… |
CVE-2021-37957 | High | 8.8 | 2021-10-08 | Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-37956 | High | 8.8 | 2021-10-08 | Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2021-41133 | High | 8.8 | 2021-10-08 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with… |
CVE-2021-22930 | Critical | 9.8 | 2021-10-07 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to chang… |
CVE-2021-41125 | Medium | 5.7 | 2021-10-06 | Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes)… |
CVE-2021-28702 | High | 7.6 | 2021-10-06 | PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region… |
CVE-2021-42008 | High | 7.8 | 2021-10-05 | The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the C… |
CVE-2021-32765 | High | 8.8 | 2021-10-04 | Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously craft… |
CVE-2021-41099 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and… |
CVE-2021-32762 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer over… |
CVE-2021-32687 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap… |
CVE-2021-32675 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory acco… |
CVE-2021-32672 | Medium | 5.3 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger… |
CVE-2021-32628 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be e… |
CVE-2021-32627 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap a… |
CVE-2021-32626 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-bas… |
CVE-2021-41103 | High | 7.8 | 2021-10-04 | containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root d… |
CVE-2021-36051 | High | 7.8 | 2021-10-04 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of… |
CVE-2021-41864 | High | 7.8 | 2021-10-02 | prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer ove… |
CVE-2021-3653 | High | 8.8 | 2021-09-29 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provi… |
CVE-2021-22947 | Medium | 5.9 | 2021-09-29 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and sen… |
CVE-2021-22946 | High | 7.5 | 2021-09-29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l… |
CVE-2021-40716 | Medium | 5.5 | 2021-09-29 | XMP Toolkit SDK versions 2021.07 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attack… |
CVE-2021-20317 | Medium | 4.4 | 2021-09-27 | A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw… |
CVE-2021-41583 | Medium | 6.5 | 2021-09-24 | vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS… |
CVE-2021-22945 | Critical | 9.1 | 2021-09-23 | When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and bo… |
CVE-2021-32280 | Medium | 5.5 | 2021-09-20 | An issue was discovered in fig2dev before 3.2.8.. A NULL pointer dereference exists in the function compute_closed_spline() located in trans_spline.c. It allow… |
CVE-2021-32278 | High | 7.8 | 2021-09-20 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function lt_prediction located in lt_predict.c. It allows an attacker to… |
CVE-2021-32277 | High | 7.8 | 2021-09-20 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker… |
CVE-2021-32276 | Medium | 5.5 | 2021-09-20 | An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to c… |
CVE-2021-32274 | High | 7.8 | 2021-09-20 | An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker… |
CVE-2021-32273 | High | 7.8 | 2021-09-20 | An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin located in mp4read.c. It allows an attacker to cause Cod… |
CVE-2021-32272 | High | 7.8 | 2021-09-20 | An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code… |
CVE-2020-21913 | Medium | 5.5 | 2021-09-20 | International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file to… |
CVE-2021-38300 | High | 7.8 | 2021-09-20 | arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing executio… |
CVE-2021-40690 | High | 7.5 | 2021-09-19 | All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passe… |
CVE-2021-41073 | High | 7.8 | 2021-09-19 | loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a fre… |
CVE-2021-3803 | High | 7.5 | 2021-09-17 | nth-check is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3805 | High | 7.5 | 2021-09-17 | object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
CVE-2020-21599 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file. |
CVE-2020-21598 | High | 8.8 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file. |
CVE-2020-21597 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file. |
CVE-2020-21596 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file. |
CVE-2020-21535 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c. |
CVE-2020-21534 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c. |
CVE-2020-21533 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c. |
CVE-2020-21532 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c. |
CVE-2020-21531 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c. |
CVE-2020-21530 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c. |
CVE-2020-21529 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c. |
CVE-2021-41079 | High | 7.5 | 2021-09-16 | Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO… |
CVE-2021-40438 | Critical | 9.0 | 2021-09-16 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4… |