Debian
Page 40 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14563 | High | 7.8 | 2020-11-23 | Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2019-14562 | Medium | 5.5 | 2020-11-23 | Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-20740 | High | 7.8 | 2020-11-20 | PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version(). |
CVE-2020-20739 | Medium | 5.3 | 2020-11-20 | im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path… |
CVE-2020-28974 | Medium | 5.0 | 2020-11-20 | A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the ke… |
CVE-2020-19667 | High | 7.8 | 2020-11-20 | Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7. |
CVE-2020-28949 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite f… |
CVE-2020-28948 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. |
CVE-2020-28941 | Medium | 5.5 | 2020-11-19 | An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver coul… |
CVE-2019-20933 | Critical | 9.8 | 2020-11-19 | InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empt… |
CVE-2020-26215 | Medium | 4.4 | 2020-11-18 | Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a diffe… |
CVE-2020-26217 | High | 8.0 | 2020-11-16 | XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by mani… |
CVE-2020-25695 | High | 8.8 | 2020-11-16 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to… |
CVE-2020-25694 | High | 8.1 | 2020-11-16 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that cre… |
CVE-2020-8698 | Medium | 5.5 | 2020-11-12 | Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local acces… |
CVE-2020-8696 | Medium | 5.5 | 2020-11-12 | Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable informat… |
CVE-2020-8695 | Medium | 5.5 | 2020-11-12 | Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local ac… |
CVE-2020-25706 | Medium | 5.4 | 2020-11-12 | A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import previ… |
CVE-2020-28368 | Medium | 4.4 | 2020-11-10 | Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a powe… |
CVE-2020-25074 | Critical | 9.8 | 2020-11-10 | The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachment… |
CVE-2017-18926 | High | 7.1 | 2020-11-06 | raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML wri… |
CVE-2020-27617 | Medium | 6.5 | 2020-11-06 | eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lack… |
CVE-2020-25592 | Critical | 9.8 | 2020-11-06 | In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. |
CVE-2020-17490 | Medium | 5.5 | 2020-11-06 | The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. |
CVE-2020-16846 | Critical | 9.8 | 2020-11-06 | An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injectio… |
CVE-2020-28242 | Medium | 6.5 | 2020-11-06 | An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk bef… |
CVE-2020-28241 | Medium | 6.5 | 2020-11-06 | libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c. |
CVE-2020-17510 | Critical | 9.8 | 2020-11-05 | Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. |
CVE-2020-28049 | Medium | 6.3 | 2020-11-04 | An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to… |
CVE-2020-8037 | High | 7.5 | 2020-11-04 | The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. |
CVE-2020-6557 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2020-16011 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2020-16009 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-16008 | High | 8.8 | 2020-11-03 | Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC… |
CVE-2020-16007 | High | 7.8 | 2020-11-03 | Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted files… |
CVE-2020-16006 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-16005 | High | 8.8 | 2020-11-03 | Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2020-16004 | High | 8.8 | 2020-11-03 | Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2020-16003 | High | 8.8 | 2020-11-03 | Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16002 | High | 8.8 | 2020-11-03 | Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2020-16001 | High | 8.8 | 2020-11-03 | Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16000 | High | 8.8 | 2020-11-03 | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-15999 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2020-15995 | High | 8.8 | 2020-11-03 | Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15992 | High | 8.8 | 2020-11-03 | Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2020-15991 | High | 8.8 | 2020-11-03 | Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2020-15990 | High | 8.8 | 2020-11-03 | Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-15989 | Medium | 5.5 | 2020-11-03 | Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2020-15988 | Medium | 6.3 | 2020-11-03 | Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files t… |
CVE-2020-15987 | High | 8.8 | 2020-11-03 | Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream. |
CVE-2020-15986 | Medium | 6.5 | 2020-11-03 | Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15985 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-15984 | Medium | 6.5 | 2020-11-03 | Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL ba… |
CVE-2020-15983 | High | 7.8 | 2020-11-03 | Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a craft… |
CVE-2020-15982 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2020-15981 | Medium | 6.5 | 2020-11-03 | Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2020-15980 | High | 7.8 | 2020-11-03 | Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via cra… |
CVE-2020-15979 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-15978 | High | 8.8 | 2020-11-03 | Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process… |
CVE-2020-15977 | Medium | 6.5 | 2020-11-03 | Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information fr… |
CVE-2020-15976 | High | 8.8 | 2020-11-03 | Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-15975 | High | 8.8 | 2020-11-03 | Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15974 | High | 8.8 | 2020-11-03 | Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2020-15973 | Medium | 6.5 | 2020-11-03 | Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15972 | High | 8.8 | 2020-11-03 | Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15971 | High | 8.8 | 2020-11-03 | Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-15970 | High | 8.8 | 2020-11-03 | Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbo… |
CVE-2020-15969 | High | 8.8 | 2020-11-03 | Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15968 | High | 8.8 | 2020-11-03 | Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15967 | High | 8.8 | 2020-11-03 | Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2020-28040 | Medium | 4.3 | 2020-11-02 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. |
CVE-2020-28039 | Critical | 9.1 | 2020-11-02 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is… |
CVE-2020-28038 | Medium | 6.1 | 2020-11-02 | WordPress before 5.5.2 allows stored XSS via post slugs. |
CVE-2020-28037 | Critical | 9.8 | 2020-11-02 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an att… |
CVE-2020-28036 | Critical | 9.8 | 2020-11-02 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. |
CVE-2020-28035 | Critical | 9.8 | 2020-11-02 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. |
CVE-2020-28034 | Medium | 6.1 | 2020-11-02 | WordPress before 5.5.2 allows XSS associated with global variables. |
CVE-2020-28033 | High | 7.5 | 2020-11-02 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. |
CVE-2020-28032 | Critical | 9.8 | 2020-11-02 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. |
CVE-2020-28030 | High | 7.5 | 2020-11-02 | In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset a… |
CVE-2020-14323 | Medium | 5.5 | 2020-10-29 | A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this f… |
CVE-2020-15238 | High | 7.1 | 2020-10-27 | Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injecti… |
CVE-2020-27216 | High | 7.0 | 2020-10-23 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's… |
CVE-2020-27675 | Medium | 4.7 | 2020-10-22 | An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal durin… |
CVE-2020-27674 | Medium | 5.3 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidat… |
CVE-2020-27673 | Medium | 5.5 | 2020-10-22 | An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a h… |
CVE-2020-27672 | High | 7.0 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privi… |
CVE-2020-27671 | High | 7.8 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or pos… |
CVE-2020-27670 | High | 7.8 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain p… |
CVE-2020-15683 | Critical | 9.8 | 2020-10-22 | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory c… |
CVE-2020-27560 | Low | 3.3 | 2020-10-22 | ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service. |
CVE-2020-27638 | High | 7.5 | 2020-10-22 | receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code. |
CVE-2020-14812 | Medium | 4.9 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and p… |
CVE-2020-14803 | Medium | 5.3 | 2020-10-21 | Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploita… |
CVE-2020-14798 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14797 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14796 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14792 | Medium | 4.2 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14782 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14781 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11… |