Debian
Page 37 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21177 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2021-21176 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar… |
CVE-2021-21175 | Medium | 6.5 | 2021-03-09 | Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2021-21174 | High | 8.8 | 2021-03-09 | Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2021-21173 | Medium | 6.5 | 2021-03-09 | Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2021-21172 | High | 8.1 | 2021-03-09 | Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass filesystem restriction… |
CVE-2021-21171 | Medium | 6.5 | 2021-03-09 | Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnib… |
CVE-2021-21170 | Medium | 6.5 | 2021-03-09 | Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents… |
CVE-2021-21169 | High | 8.8 | 2021-03-09 | Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memory access via a cra… |
CVE-2021-21168 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2021-21167 | High | 8.8 | 2021-03-09 | Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21166 | High | 8.8 | 2021-03-09 | Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21165 | High | 8.8 | 2021-03-09 | Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21164 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2021-21163 | Medium | 6.5 | 2021-03-09 | Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2021-21162 | High | 8.8 | 2021-03-09 | Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21161 | High | 8.8 | 2021-03-09 | Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2021-21160 | High | 8.8 | 2021-03-09 | Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2021-21159 | High | 8.8 | 2021-03-09 | Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2021-20243 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavio… |
CVE-2021-20241 | Medium | 5.5 | 2021-03-09 | A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in th… |
CVE-2021-20276 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may lead to denial of service. |
CVE-2021-20275 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service. |
CVE-2021-20273 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off. |
CVE-2021-20272 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading to server crash. |
CVE-2021-27365 | High | 7.8 | 2021-03-07 | An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed… |
CVE-2021-27364 | High | 7.1 | 2021-03-07 | An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to… |
CVE-2021-27363 | Medium | 4.4 | 2021-03-07 | An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When a… |
CVE-2021-28038 | Medium | 6.5 | 2021-03-05 | An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such… |
CVE-2020-35636 | Critical | 9.8 | 2021-03-04 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface()… |
CVE-2020-35628 | Critical | 9.8 | 2021-03-04 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa… |
CVE-2020-28636 | Critical | 9.8 | 2021-03-04 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa… |
CVE-2020-28601 | Critical | 9.8 | 2021-03-04 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_pars… |
CVE-2021-25329 | High | 7.0 | 2021-03-01 | The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configu… |
CVE-2021-25122 | High | 7.5 | 2021-03-01 | When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request head… |
CVE-2021-3197 | Critical | 9.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument… |
CVE-2021-3148 | Critical | 9.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injectio… |
CVE-2021-3144 | Critical | 9.1 | 2021-02-27 | In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) |
CVE-2021-25284 | Medium | 4.4 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. |
CVE-2021-25283 | Critical | 9.8 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. |
CVE-2021-25282 | Critical | 9.1 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. |
CVE-2021-25281 | Critical | 9.8 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can re… |
CVE-2020-35662 | High | 7.4 | 2021-02-27 | In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. |
CVE-2020-28972 | Medium | 5.9 | 2021-02-27 | In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS cert… |
CVE-2020-28243 | High | 7.8 | 2021-02-27 | An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows f… |
CVE-2021-27803 | High | 7.5 | 2021-02-26 | A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in… |
CVE-2020-27618 | Medium | 5.5 | 2021-02-26 | The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388… |
CVE-2020-27223 | Medium | 5.2 | 2021-02-26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a lar… |
CVE-2021-23978 | High | 8.8 | 2021-02-26 | Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2021-23961 | High | 7.4 | 2021-02-26 | Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as servi… |
CVE-2021-21330 | Low | 3.1 | 2021-02-26 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A mali… |
CVE-2021-23973 | Medium | 6.5 | 2021-02-26 | When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed infor… |
CVE-2021-23969 | Medium | 4.3 | 2021-02-26 | As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested… |
CVE-2021-23968 | Medium | 4.3 | 2021-02-26 | If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to… |
CVE-2021-20203 | Low | 3.2 | 2021-02-25 | An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for… |
CVE-2020-11987 | High | 8.2 | 2021-02-24 | Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argume… |
CVE-2021-27645 | Low | 2.5 | 2021-02-24 | The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due… |
CVE-2021-3410 | High | 7.8 | 2021-02-23 | A flaw was found in libcaca v0.99.beta19. A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local execution of arbitrary cod… |
CVE-2021-3407 | Medium | 5.5 | 2021-02-23 | A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences. |
CVE-2021-3405 | Medium | 6.5 | 2021-02-23 | A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. |
CVE-2021-20247 | High | 7.4 | 2021-02-23 | A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromis… |
CVE-2020-27768 | Low | 3.3 | 2021-02-23 | In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick ver… |
CVE-2021-26120 | Critical | 9.8 | 2021-02-22 | Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. |
CVE-2021-26119 | High | 7.5 | 2021-02-22 | Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode. |
CVE-2021-27379 | High | 7.8 | 2021-02-18 | An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial o… |
CVE-2020-8625 | High | 8.1 | 2021-02-17 | BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default s… |
CVE-2021-26720 | High | 7.8 | 2021-02-17 | avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to c… |
CVE-2021-26933 | Medium | 5.5 | 2021-02-17 | An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen n… |
CVE-2021-26932 | Medium | 5.5 | 2021-02-17 | An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of op… |
CVE-2021-26931 | Medium | 5.5 | 2021-02-17 | An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, delibera… |
CVE-2021-26930 | High | 7.8 | 2021-02-17 | An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provi… |
CVE-2021-23841 | Medium | 5.9 | 2021-02-16 | The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained withi… |
CVE-2021-23840 | High | 7.5 | 2021-02-16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the… |
CVE-2021-27229 | High | 8.8 | 2021-02-16 | Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text. |
CVE-2021-27219 | High | 7.5 | 2021-02-15 | An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an im… |
CVE-2021-27218 | High | 7.5 | 2021-02-15 | An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit pl… |
CVE-2021-23336 | Medium | 5.9 | 2021-02-15 | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to W… |
CVE-2021-21702 | Medium | 5.3 | 2021-02-15 | In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server co… |
CVE-2020-7071 | Medium | 5.3 | 2021-02-15 | In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accep… |
CVE-2021-26929 | Medium | 6.1 | 2021-02-14 | An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send… |
CVE-2021-27212 | High | 7.5 | 2021-02-14 | In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet… |
CVE-2021-21311 | High | 7.2 | 2021-02-11 | Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulne… |
CVE-2020-35498 | High | 7.5 | 2021-02-11 | A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted… |
CVE-2021-0326 | High | 7.5 | 2021-02-10 | In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target… |
CVE-2021-27135 | Critical | 9.8 | 2021-02-10 | xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining chara… |
CVE-2020-36244 | Critical | 9.8 | 2021-02-10 | The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary c… |
CVE-2021-26937 | Critical | 9.8 | 2021-02-09 | encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspe… |
CVE-2021-26676 | Medium | 6.5 | 2021-02-09 | gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp. |
CVE-2021-26675 | High | 8.8 | 2021-02-09 | A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code. |
CVE-2021-21148 | High | 8.8 | 2021-02-09 | Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-26910 | High | 7.8 | 2021-02-08 | Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an Overl… |
CVE-2021-21290 | Medium | 6.2 | 2021-02-08 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2021-20176 | Medium | 5.5 | 2021-02-06 | A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by I… |
CVE-2021-21289 | High | 7.4 | 2021-02-02 | Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command… |
CVE-2021-21285 | Medium | 6.5 | 2021-02-02 | In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemo… |
CVE-2021-21284 | Medium | 6.8 | 2021-02-02 | In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escal… |
CVE-2021-3348 | High | 7.0 | 2021-02-01 | nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with a… |
CVE-2020-17380 | Medium | 6.3 | 2021-01-30 | A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via… |
CVE-2021-3347 | High | 7.8 | 2021-01-29 | An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execu… |
CVE-2021-3326 | High | 7.5 | 2021-01-27 | The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an… |