Debian
Page 31 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39275 | Critical | 9.8 | 2021-09-16 | ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party… |
CVE-2021-36160 | High | 7.5 | 2021-09-16 | A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versio… |
CVE-2021-34798 | High | 7.5 | 2021-09-16 | Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. |
CVE-2021-3796 | High | 7.3 | 2021-09-15 | vim is vulnerable to Use After Free |
CVE-2021-3778 | High | 7.8 | 2021-09-15 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2021-31891 | Critical | 10.0 | 2021-09-14 | A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier)… |
CVE-2021-41072 | High | 8.1 | 2021-09-14 | squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that ha… |
CVE-2021-41054 | High | 7.5 | 2021-09-13 | tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other opti… |
CVE-2021-39201 | High | 7.6 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authen… |
CVE-2021-39200 | Medium | 5.3 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of t… |
CVE-2020-19144 | Medium | 6.5 | 2021-09-09 | Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'. |
CVE-2020-19143 | Medium | 6.5 | 2021-09-09 | Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/tif_dir.c'. |
CVE-2021-3761 | High | 7.5 | 2021-09-09 | Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can… |
CVE-2021-40346 | High | 7.5 | 2021-09-08 | An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker… |
CVE-2021-21897 | High | 8.8 | 2021-09-08 | A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to… |
CVE-2021-21996 | High | 7.5 | 2021-09-08 | An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on… |
CVE-2021-28701 | High | 7.8 | 2021-09-08 | Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated… |
CVE-2021-39263 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. |
CVE-2021-39262 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22. |
CVE-2021-39261 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22. |
CVE-2021-39260 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22. |
CVE-2021-39259 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22. |
CVE-2021-39258 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22. |
CVE-2021-39257 | Medium | 5.5 | 2021-09-07 | A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption… |
CVE-2021-39256 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22. |
CVE-2021-39255 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22. |
CVE-2021-39254 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 20… |
CVE-2021-39253 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22. |
CVE-2021-39252 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22. |
CVE-2021-39251 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22. |
CVE-2021-35267 | High | 7.8 | 2021-09-07 | NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation… |
CVE-2021-35266 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory… |
CVE-2021-33287 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow… |
CVE-2021-33286 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execu… |
CVE-2020-19131 | High | 7.5 | 2021-09-07 | Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop". |
CVE-2021-35269 | High | 7.8 | 2021-09-07 | NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can oc… |
CVE-2021-35268 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing… |
CVE-2021-33289 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code executio… |
CVE-2021-33285 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur… |
CVE-2021-40516 | High | 7.5 | 2021-09-05 | WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/r… |
CVE-2021-39191 | Medium | 4.7 | 2021-09-03 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-40491 | Medium | 6.5 | 2021-09-03 | The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is simi… |
CVE-2021-40490 | High | 7.0 | 2021-09-03 | A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13. |
CVE-2021-39847 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in th… |
CVE-2021-36064 | High | 7.8 | 2021-09-01 | XMP Toolkit version 2020.1 (and earlier) is affected by a Buffer Underflow vulnerability which could result in arbitrary code execution in the context of the c… |
CVE-2021-36058 | Medium | 5.5 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Integer Overflow vulnerability potentially resulting in application-level denial of service in t… |
CVE-2021-36057 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a write-what-where condition vulnerability caused during the application's memory allocation proces… |
CVE-2021-36056 | Medium | 5.5 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36055 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK versions 2020.1 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2021-36054 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in local application denial of service in the… |
CVE-2021-36053 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacke… |
CVE-2021-36052 | High | 7.8 | 2021-09-01 | XMP Toolkit version 2020.1 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36050 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36048 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the… |
CVE-2021-36047 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the… |
CVE-2021-36046 | High | 7.8 | 2021-09-01 | XMP Toolkit version 2020.1 (and earlier) is affected by a memory corruption vulnerability, potentially resulting in arbitrary code execution in the context of… |
CVE-2021-36045 | Low | 3.3 | 2021-09-01 | XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacke… |
CVE-2021-33582 | High | 7.5 | 2021-09-01 | Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table inter… |
CVE-2021-40085 | Medium | 6.5 | 2021-08-31 | An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a c… |
CVE-2021-3634 | Medium | 6.5 | 2021-08-31 | A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them… |
CVE-2021-37712 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabil… |
CVE-2021-37701 | High | 8.2 | 2021-08-31 | The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabili… |
CVE-2021-40330 | High | 7.5 | 2021-08-31 | git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol reques… |
CVE-2020-35635 | High | 8.8 | 2021-08-30 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface()… |
CVE-2020-35634 | High | 8.8 | 2021-08-30 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa… |
CVE-2020-35633 | High | 8.8 | 2021-08-30 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa… |
CVE-2021-28700 | Medium | 4.9 | 2021-08-27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunate… |
CVE-2021-28699 | Medium | 5.5 | 2021-08-27 | inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this… |
CVE-2021-28698 | Medium | 5.5 | 2021-08-27 | long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to ma… |
CVE-2021-28697 | High | 7.8 | 2021-08-27 | grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pag… |
CVE-2021-28696 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28695 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28694 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2020-23226 | Medium | 6.1 | 2021-08-27 | Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templa… |
CVE-2021-23434 | Medium | 5.6 | 2021-08-27 | This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the… |
CVE-2021-40153 | High | 8.1 | 2021-08-27 | squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file durin… |
CVE-2021-3713 | High | 7.4 | 2021-08-25 | An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplie… |
CVE-2021-3605 | Medium | 5.5 | 2021-08-25 | There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked w… |
CVE-2021-21850 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |
CVE-2021-21849 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |
CVE-2021-21848 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The libra… |
CVE-2021-21842 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |
CVE-2021-21841 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |
CVE-2021-21840 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |
CVE-2021-21836 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |
CVE-2021-21834 | High | 8.8 | 2021-08-25 | An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A special… |
CVE-2021-30984 | High | 7.5 | 2021-08-24 | A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watc… |
CVE-2021-30954 | High | 7.8 | 2021-08-24 | A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15… |
CVE-2021-30953 | High | 8.8 | 2021-08-24 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2… |
CVE-2021-30952 | High | 7.8 | 2021-08-24 | An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2… |
CVE-2021-30951 | High | 8.8 | 2021-08-24 | A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 1… |
CVE-2021-30936 | High | 8.8 | 2021-08-24 | A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 1… |
CVE-2021-30934 | High | 8.8 | 2021-08-24 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15… |
CVE-2021-30890 | Medium | 6.1 | 2021-08-24 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Pro… |
CVE-2021-30887 | Medium | 6.5 | 2021-08-24 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Process… |
CVE-2021-30858 | High | 8.8 | 2021-08-24 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing malicious… |
CVE-2021-30851 | High | 8.8 | 2021-08-24 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing m… |
CVE-2021-3712 | High | 7.4 | 2021-08-24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buf… |
CVE-2021-3711 | Critical | 9.8 | 2021-08-24 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function… |
CVE-2021-38714 | High | 8.8 | 2021-08-24 | In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() func… |