Debian
Page 42 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15959 | Medium | 4.3 | 2020-09-21 | Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable logging to obtain po… |
CVE-2020-14390 | Medium | 5.6 | 2020-09-18 | A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruptio… |
CVE-2020-24750 | High | 8.1 | 2020-09-17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.confi… |
CVE-2020-0427 | Medium | 5.5 | 2020-09-17 | In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional… |
CVE-2019-20919 | Medium | 4.7 | 2020-09-17 | An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly t… |
CVE-2020-14393 | High | 7.1 | 2020-09-16 | A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bou… |
CVE-2020-14392 | Medium | 5.5 | 2020-09-16 | An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory… |
CVE-2020-14386 | Medium | 6.7 | 2020-09-16 | A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat… |
CVE-2020-10781 | Medium | 5.5 | 2020-09-16 | A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-co… |
CVE-2020-14385 | Medium | 5.5 | 2020-09-15 | A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable ext… |
CVE-2020-14314 | Medium | 5.5 | 2020-09-15 | A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken in… |
CVE-2020-8927 | Medium | 5.3 | 2020-09-15 | A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to… |
CVE-2020-24660 | Critical | 9.8 | 2020-09-14 | An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submi… |
CVE-2020-25285 | Medium | 6.4 | 2020-09-13 | A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a N… |
CVE-2020-25284 | Medium | 4.1 | 2020-09-13 | The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could… |
CVE-2020-14332 | Medium | 5.5 | 2020-09-11 | A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed… |
CVE-2020-14330 | Medium | 5.0 | 2020-09-11 | An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. Thi… |
CVE-2020-15169 | Medium | 5.4 | 2020-09-11 | In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views th… |
CVE-2020-15166 | High | 7.5 | 2020-09-11 | In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacte… |
CVE-2020-25269 | Medium | 6.5 | 2020-09-11 | An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlaut… |
CVE-2019-20917 | Medium | 6.5 | 2020-09-11 | An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connect… |
CVE-2020-13920 | Medium | 5.9 | 2020-09-10 | Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to th… |
CVE-2020-6097 | High | 7.5 | 2020-09-10 | An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-M… |
CVE-2020-25219 | High | 7.5 | 2020-09-09 | url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite… |
CVE-2020-24916 | Critical | 9.8 | 2020-09-09 | CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. |
CVE-2020-24379 | Critical | 9.8 | 2020-09-09 | WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. |
CVE-2020-7068 | Medium | 4.8 | 2020-09-09 | In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tri… |
CVE-2020-25212 | High | 7.0 | 2020-09-09 | A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other… |
CVE-2020-25211 | Medium | 6.0 | 2020-09-09 | In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering… |
CVE-2020-1968 | Low | 3.7 | 2020-09-09 | The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have… |
CVE-2020-3702 | Medium | 6.5 | 2020-09-08 | u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possib… |
CVE-2019-20916 | High | 7.5 | 2020-09-04 | The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../… |
CVE-2020-24977 | Medium | 6.5 | 2020-09-04 | GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commi… |
CVE-2020-7729 | High | 7.1 | 2020-09-03 | The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement saf… |
CVE-2020-24654 | Low | 3.3 | 2020-09-02 | In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a us… |
CVE-2020-15811 | Medium | 6.5 | 2020-09-02 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP an… |
CVE-2020-15810 | Medium | 6.5 | 2020-09-02 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP an… |
CVE-2020-16150 | Medium | 5.5 | 2020-09-02 | A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret… |
CVE-2020-25073 | Medium | 5.3 | 2020-09-02 | FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection f… |
CVE-2020-14364 | Medium | 5.0 | 2020-08-31 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from… |
CVE-2020-12829 | Low | 3.8 | 2020-08-31 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO wr… |
CVE-2020-25032 | High | 7.5 | 2020-08-31 | An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resou… |
CVE-2020-8244 | Medium | 6.5 | 2020-08-30 | A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it end… |
CVE-2019-14904 | High | 7.3 | 2020-08-26 | A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checke… |
CVE-2020-24616 | High | 8.1 | 2020-08-25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPD… |
CVE-2020-24606 | High | 8.6 | 2020-08-24 | Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Ca… |
CVE-2020-14350 | High | 7.3 | 2020-08-24 | It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this… |
CVE-2020-8624 | Medium | 4.3 | 2020-08-21 | In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1… |
CVE-2020-8623 | High | 7.5 | 2020-08-21 | In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that c… |
CVE-2020-8622 | Medium | 6.5 | 2020-08-21 | In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the n… |
CVE-2020-24368 | High | 7.5 | 2020-08-19 | Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are rea… |
CVE-2020-14356 | High | 7.8 | 2020-08-19 | A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user coul… |
CVE-2020-13933 | High | 7.5 | 2020-08-17 | Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. |
CVE-2020-1472 | Medium | 5.5 | 2020-08-17 | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the N… |
CVE-2020-24370 | Medium | 5.3 | 2020-08-17 | ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). |
CVE-2020-24361 | Critical | 9.8 | 2020-08-16 | SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec. |
CVE-2020-17538 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to… |
CVE-2020-16310 | Medium | 5.5 | 2020-08-13 | A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial o… |
CVE-2020-16309 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16308 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of ser… |
CVE-2020-16307 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause… |
CVE-2020-16306 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via… |
CVE-2020-16305 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a deni… |
CVE-2020-16304 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to es… |
CVE-2020-16303 | High | 7.8 | 2020-08-13 | A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalat… |
CVE-2020-16302 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privi… |
CVE-2020-16301 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16300 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in tiff12_print_page() in devices/gdevtfnx.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial o… |
CVE-2020-16299 | Medium | 5.5 | 2020-08-13 | A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a… |
CVE-2020-16298 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in mj_color_correct() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a d… |
CVE-2020-16297 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to… |
CVE-2020-16296 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in GetNumWrongData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker t… |
CVE-2020-16295 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in clj_media_size() in devices/gdevclj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a den… |
CVE-2020-16294 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in epsc_print_page() in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of… |
CVE-2020-16293 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in compose_group_nonknockout_nonblend_isolated_allmask_common() in base/gxblend.c of Artifex Software GhostScript v9.5… |
CVE-2020-16292 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in mj_raster_cmd() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a deni… |
CVE-2020-16291 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in contrib/gdevdj9.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of service via a… |
CVE-2020-16290 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16289 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of se… |
CVE-2020-16288 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in pj_common_print_page() in devices/gdevpjet.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denia… |
CVE-2020-16287 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in lprn_is_black() in contrib/lips4/gdevlprn.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-17507 | Medium | 5.3 | 2020-08-12 | An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. |
CVE-2020-17446 | Critical | 9.8 | 2020-08-12 | asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, b… |
CVE-2020-12674 | High | 7.5 | 2020-08-12 | In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. |
CVE-2020-12673 | High | 7.5 | 2020-08-12 | In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. |
CVE-2020-12100 | High | 7.5 | 2020-08-12 | In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via… |
CVE-2020-17489 | Medium | 4.3 | 2020-08-11 | An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog r… |
CVE-2020-0256 | Medium | 6.8 | 2020-08-11 | In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege when i… |
CVE-2020-17368 | Critical | 9.8 | 2020-08-11 | Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection. |
CVE-2020-17367 | High | 7.8 | 2020-08-11 | Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection. |
CVE-2020-16092 | Low | 3.8 | 2020-08-11 | In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious… |
CVE-2020-9490 | High | 7.5 | 2020-08-07 | Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the serv… |
CVE-2020-11993 | High | 7.5 | 2020-08-07 | Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were m… |
CVE-2020-11984 | Critical | 9.8 | 2020-08-07 | Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE |
CVE-2020-16845 | High | 7.5 | 2020-08-06 | Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. |
CVE-2020-17353 | Critical | 9.8 | 2020-08-05 | scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg… |
CVE-2020-14347 | Medium | 5.5 | 2020-08-05 | A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server run… |
CVE-2020-16116 | Low | 3.3 | 2020-08-03 | In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal. |
CVE-2020-16166 | Low | 3.7 | 2020-07-30 | The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network… |
CVE-2020-10713 | High | 8.2 | 2020-07-30 | A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows… |