Debian
Page 36 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-30158 | Medium | 5.3 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has secu… |
CVE-2021-30157 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Spe… |
CVE-2021-30154 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are… |
CVE-2021-30151 | Medium | 6.1 | 2021-04-06 | Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. |
CVE-2021-20308 | Critical | 9.8 | 2021-04-05 | Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181. |
CVE-2021-20307 | Critical | 9.8 | 2021-04-05 | Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values. |
CVE-2021-20305 | High | 8.1 | 2021-04-05 | A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Cur… |
CVE-2021-1871 | Critical | 9.8 | 2021-04-02 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001… |
CVE-2021-1844 | High | 8.8 | 2021-04-02 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 1561… |
CVE-2021-1788 | High | 8.8 | 2021-04-02 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Up… |
CVE-2020-10001 | Medium | 5.5 | 2021-04-02 | An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security U… |
CVE-2021-30002 | Medium | 6.2 | 2021-04-02 | An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak… |
CVE-2021-22890 | Low | 3.7 | 2021-04-01 | curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tick… |
CVE-2021-22876 | Medium | 5.3 | 2021-04-01 | curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP R… |
CVE-2021-20296 | Medium | 5.3 | 2021-04-01 | A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionali… |
CVE-2021-3479 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenE… |
CVE-2021-3478 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenE… |
CVE-2021-3477 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed… |
CVE-2021-29650 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter… |
CVE-2021-29647 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory… |
CVE-2021-3476 | Medium | 5.3 | 2021-03-30 | A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could… |
CVE-2021-3475 | Medium | 5.3 | 2021-03-30 | There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow… |
CVE-2021-3474 | Medium | 5.3 | 2021-03-30 | There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder… |
CVE-2021-21409 | Medium | 5.9 | 2021-03-30 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2021-29376 | High | 7.5 | 2021-03-30 | ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) v… |
CVE-2021-23358 | Low | 3.3 | 2021-03-29 | The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, pa… |
CVE-2021-29265 | Medium | 4.7 | 2021-03-26 | An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GP… |
CVE-2021-29264 | Medium | 5.5 | 2021-03-26 | An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers… |
CVE-2021-3449 | Medium | 5.9 | 2021-03-25 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the… |
CVE-2020-1946 | Critical | 9.8 | 2021-03-25 | In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this… |
CVE-2021-3409 | Medium | 5.7 | 2021-03-23 | The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously f… |
CVE-2021-3392 | Low | 3.2 | 2021-03-23 | A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_requ… |
CVE-2021-3444 | High | 7.8 | 2021-03-23 | The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker… |
CVE-2021-20270 | High | 7.5 | 2021-03-23 | An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source… |
CVE-2021-21351 | Medium | 5.4 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to… |
CVE-2021-21350 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21349 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21348 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21347 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21346 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21345 | Medium | 5.8 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21344 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21343 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21342 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21341 | High | 7.5 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacke… |
CVE-2021-28971 | Medium | 5.5 | 2021-03-22 | In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer)… |
CVE-2021-28964 | Medium | 4.7 | 2021-03-22 | A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG)… |
CVE-2021-28963 | Medium | 5.3 | 2021-03-22 | Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. |
CVE-2021-28957 | Medium | 6.1 | 2021-03-21 | An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner cl… |
CVE-2020-27171 | Medium | 6.0 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-… |
CVE-2020-27170 | Medium | 4.7 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading… |
CVE-2021-28950 | Medium | 5.5 | 2021-03-20 | An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad i… |
CVE-2021-28834 | Critical | 9.8 | 2021-03-19 | Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. |
CVE-2021-28831 | High | 7.5 | 2021-03-19 | decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, v… |
CVE-2020-25097 | High | 8.6 | 2021-03-19 | An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smugg… |
CVE-2021-25290 | High | 7.5 | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. |
CVE-2021-27928 | High | 7.2 | 2021-03-19 | A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server t… |
CVE-2021-3416 | Medium | 6.0 | 2021-03-18 | A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopba… |
CVE-2021-28660 | High | 8.8 | 2021-03-17 | rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE… |
CVE-2021-27291 | High | 7.5 | 2021-03-17 | In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have expo… |
CVE-2020-17525 | High | 7.5 | 2021-03-17 | Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client send… |
CVE-2017-20002 | High | 7.8 | 2021-03-17 | The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login… |
CVE-2021-21193 | High | 8.8 | 2021-03-16 | Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21192 | High | 8.8 | 2021-03-16 | Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-21191 | High | 8.8 | 2021-03-16 | Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-22191 | Medium | 6.3 | 2021-03-15 | Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file. |
CVE-2021-28374 | High | 7.5 | 2021-03-15 | The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowi… |
CVE-2021-21366 | Medium | 4.3 | 2021-03-12 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly pres… |
CVE-2020-36281 | High | 7.5 | 2021-03-12 | Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c. |
CVE-2020-36279 | High | 7.5 | 2021-03-12 | Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c. |
CVE-2020-36278 | High | 7.5 | 2021-03-12 | Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c. |
CVE-2021-28153 | Medium | 5.3 | 2021-03-11 | An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling… |
CVE-2020-36277 | High | 7.5 | 2021-03-11 | Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c. |
CVE-2021-21381 | High | 7.1 | 2021-03-11 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2… |
CVE-2021-21375 | Medium | 6.5 | 2021-03-10 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2021-21772 | High | 8.1 | 2021-03-10 | A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file ca… |
CVE-2020-13959 | Medium | 6.1 | 2021-03-10 | The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can se… |
CVE-2020-13936 | High | 8.8 | 2021-03-10 | An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account… |
CVE-2021-28116 | Low | 3.7 | 2021-03-09 | Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This ca… |
CVE-2021-21300 | High | 8.0 | 2021-03-09 | Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as f… |
CVE-2021-20255 | Medium | 5.5 | 2021-03-09 | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controlle… |
CVE-2020-35524 | High | 7.8 | 2021-03-09 | A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arb… |
CVE-2020-35523 | High | 7.8 | 2021-03-09 | An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a… |
CVE-2021-21295 | Medium | 5.9 | 2021-03-09 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2021-20246 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behav… |
CVE-2021-20245 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in t… |
CVE-2021-20244 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined… |
CVE-2021-21190 | High | 8.8 | 2021-03-09 | Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21189 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2021-21188 | High | 8.8 | 2021-03-09 | Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21187 | Medium | 4.3 | 2021-03-09 | Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing via IDN homographs v… |
CVE-2021-21186 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to by… |
CVE-2021-21185 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2021-21184 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21183 | Medium | 4.3 | 2021-03-09 | Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21182 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2021-21181 | Medium | 6.5 | 2021-03-09 | Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from… |
CVE-2021-21180 | High | 8.8 | 2021-03-09 | Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21179 | High | 8.8 | 2021-03-09 | Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2021-21178 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the… |