Debian
Page 41 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14779 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8… |
CVE-2020-14765 | Medium | 6.5 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior… |
CVE-2020-9951 | High | 8.8 | 2020-10-16 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead t… |
CVE-2020-9948 | High | 8.8 | 2020-10-16 | A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to… |
CVE-2020-15157 | Medium | 6.1 | 2020-10-16 | In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the… |
CVE-2020-27153 | High | 8.6 | 2020-10-15 | In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of… |
CVE-2020-0423 | High | 7.8 | 2020-10-14 | In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel… |
CVE-2020-25645 | High | 7.5 | 2020-10-13 | A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt tr… |
CVE-2020-15250 | Medium | 4.4 | 2020-10-12 | In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the sy… |
CVE-2020-13943 | Medium | 4.3 | 2020-10-12 | If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent… |
CVE-2020-26935 | Critical | 9.8 | 2020-10-10 | An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin pro… |
CVE-2020-26934 | Medium | 6.1 | 2020-10-10 | phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. |
CVE-2020-26932 | Medium | 4.3 | 2020-10-10 | debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode… |
CVE-2020-26880 | High | 7.8 | 2020-10-07 | Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (whi… |
CVE-2020-26870 | Medium | 6.1 | 2020-10-07 | Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a na… |
CVE-2020-11800 | Critical | 9.8 | 2020-10-07 | Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. |
CVE-2020-14355 | Medium | 6.6 | 2020-10-07 | Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPIC… |
CVE-2020-26575 | High | 7.5 | 2020-10-06 | In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero… |
CVE-2020-25863 | High | 7.5 | 2020-10-06 | In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multi… |
CVE-2020-25862 | High | 7.5 | 2020-10-06 | In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changin… |
CVE-2020-25643 | High | 7.2 | 2020-10-06 | A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input valid… |
CVE-2020-25641 | Medium | 5.5 | 2020-10-06 | A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could c… |
CVE-2020-15598 | High | 7.5 | 2020-10-06 | Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing… |
CVE-2020-26572 | Medium | 5.5 | 2020-10-06 | The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher. |
CVE-2020-26571 | Medium | 5.5 | 2020-10-06 | The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init. |
CVE-2020-26570 | Medium | 5.5 | 2020-10-06 | The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file. |
CVE-2019-14558 | Medium | 5.7 | 2020-10-05 | Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Process… |
CVE-2020-7070 | Medium | 4.3 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-dec… |
CVE-2020-7069 | Medium | 5.4 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only… |
CVE-2020-26519 | Medium | 5.5 | 2020-10-02 | Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service. |
CVE-2020-15678 | High | 8.8 | 2020-10-01 | When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the… |
CVE-2020-15677 | Medium | 6.1 | 2020-10-01 | By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original s… |
CVE-2020-15676 | Medium | 6.1 | 2020-10-01 | Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attack… |
CVE-2020-15673 | High | 8.8 | 2020-10-01 | Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2020-15227 | High | 8.7 | 2020-10-01 | Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL th… |
CVE-2020-25626 | Medium | 6.1 | 2020-09-30 | A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to proper… |
CVE-2020-26154 | Critical | 9.8 | 2020-09-30 | url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-l… |
CVE-2020-26137 | Medium | 6.5 | 2020-09-30 | urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the… |
CVE-2020-26117 | High | 8.1 | 2020-09-27 | In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as autho… |
CVE-2020-26116 | High | 7.2 | 2020-09-27 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTT… |
CVE-2020-25625 | Medium | 5.3 | 2020-09-25 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. |
CVE-2020-25085 | Medium | 5.0 | 2020-09-25 | QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case. |
CVE-2020-25084 | Low | 3.2 | 2020-09-25 | QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. |
CVE-2020-26088 | Medium | 5.5 | 2020-09-24 | A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets… |
CVE-2020-25604 | Medium | 4.7 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests b… |
CVE-2020-25603 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures… |
CVE-2020-25602 | Medium | 6.0 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses… |
CVE-2020-25601 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model… |
CVE-2020-25600 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model impo… |
CVE-2020-25599 | High | 7.0 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCT… |
CVE-2020-25596 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various stat… |
CVE-2020-25595 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified th… |
CVE-2020-25739 | Medium | 6.1 | 2020-09-23 | An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mech… |
CVE-2020-14365 | High | 7.1 | 2020-09-23 | A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf mo… |
CVE-2020-6576 | High | 8.8 | 2020-09-21 | Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6575 | High | 8.3 | 2020-09-21 | Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape… |
CVE-2020-6574 | High | 7.8 | 2020-09-21 | Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalati… |
CVE-2020-6573 | Critical | 9.6 | 2020-09-21 | Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2020-6571 | Medium | 4.3 | 2020-09-21 | Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a cr… |
CVE-2020-6570 | Medium | 4.3 | 2020-09-21 | Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC… |
CVE-2020-6569 | Medium | 6.3 | 2020-09-21 | Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit hea… |
CVE-2020-6568 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restriction… |
CVE-2020-6567 | Medium | 6.5 | 2020-09-21 | Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navig… |
CVE-2020-6566 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6565 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2020-6564 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a… |
CVE-2020-6563 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive… |
CVE-2020-6562 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6561 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafte… |
CVE-2020-6560 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6559 | High | 8.8 | 2020-09-21 | Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-6558 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2020-6556 | High | 8.8 | 2020-09-21 | Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6555 | High | 7.6 | 2020-09-21 | Out of bounds read in WebGL in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2020-6554 | High | 8.6 | 2020-09-21 | Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Ext… |
CVE-2020-6553 | High | 8.8 | 2020-09-21 | Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-6552 | High | 8.8 | 2020-09-21 | Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6551 | High | 8.8 | 2020-09-21 | Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6550 | High | 8.8 | 2020-09-21 | Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6549 | High | 8.8 | 2020-09-21 | Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6548 | High | 8.8 | 2020-09-21 | Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.125 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2020-6547 | Medium | 6.5 | 2020-09-21 | Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML… |
CVE-2020-6546 | High | 7.8 | 2020-09-21 | Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted files… |
CVE-2020-6545 | High | 8.8 | 2020-09-21 | Use after free in audio in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6544 | High | 8.8 | 2020-09-21 | Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6543 | High | 8.8 | 2020-09-21 | Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-6542 | High | 8.8 | 2020-09-21 | Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6541 | High | 8.8 | 2020-09-21 | Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6540 | High | 8.8 | 2020-09-21 | Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6539 | High | 8.8 | 2020-09-21 | Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6538 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2020-6537 | High | 8.8 | 2020-09-21 | Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2020-6532 | High | 8.8 | 2020-09-21 | Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15966 | Medium | 4.3 | 2020-09-21 | Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15965 | High | 8.8 | 2020-09-21 | Type confusion in V8 in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2020-15964 | High | 8.8 | 2020-09-21 | Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-15963 | Critical | 9.6 | 2020-09-21 | Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15962 | High | 8.8 | 2020-09-21 | Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access v… |
CVE-2020-15961 | Critical | 9.6 | 2020-09-21 | Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15960 | High | 8.8 | 2020-09-21 | Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a craf… |