Debian
Page 51 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19269 | Medium | 4.9 | 2019-11-30 | An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509… |
CVE-2019-19462 | Medium | 5.5 | 2019-11-30 | relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL al… |
CVE-2015-0837 | Medium | 5.9 | 2019-11-29 | The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when… |
CVE-2014-3591 | Medium | 4.2 | 2019-11-29 | Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to ob… |
CVE-2015-1855 | Medium | 5.9 | 2019-11-29 | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate… |
CVE-2019-14901 | Critical | 9.8 | 2019-11-29 | A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote… |
CVE-2019-14897 | Critical | 9.8 | 2019-11-29 | A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of servi… |
CVE-2019-14895 | Critical | 9.8 | 2019-11-29 | A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur… |
CVE-2019-19318 | Medium | 4.4 | 2019-11-28 | In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in k… |
CVE-2011-2523 | Critical | 9.8 | 2019-11-27 | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. |
CVE-2011-2515 | Medium | 5.3 | 2019-11-27 | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of… |
CVE-2013-2625 | Medium | 6.5 | 2019-11-27 | An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2… |
CVE-2011-2207 | Medium | 5.3 | 2019-11-27 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certific… |
CVE-2012-6655 | Low | 3.3 | 2019-11-27 | An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords. |
CVE-2012-2248 | High | 8.1 | 2019-11-27 | An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable. |
CVE-2011-2187 | High | 7.8 | 2019-11-27 | xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attacke… |
CVE-2016-1000110 | Medium | 6.1 | 2019-11-27 | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker t… |
CVE-2019-19330 | Critical | 9.8 | 2019-11-27 | The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the z… |
CVE-2019-10220 | High | 8.8 | 2019-11-27 | Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. |
CVE-2019-14896 | Critical | 9.8 | 2019-11-27 | A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a d… |
CVE-2011-1939 | Critical | 9.8 | 2019-11-26 | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql… |
CVE-2011-1934 | Medium | 4.3 | 2019-11-26 | lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1. |
CVE-2019-16255 | High | 8.1 | 2019-11-26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#… |
CVE-2019-16254 | Medium | 5.3 | 2019-11-26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the re… |
CVE-2019-16201 | High | 7.5 | 2019-11-26 | WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/b… |
CVE-2019-18679 | High | 7.5 | 2019-11-26 | An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HT… |
CVE-2019-18678 | Medium | 5.3 | 2019-11-26 | An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that split… |
CVE-2019-18676 | High | 7.5 | 2019-11-26 | An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of… |
CVE-2019-12526 | Critical | 9.8 | 2019-11-26 | An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server… |
CVE-2019-12523 | Critical | 9.1 | 2019-11-26 | An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access… |
CVE-2011-4350 | Medium | 6.5 | 2019-11-26 | Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of a… |
CVE-2011-4120 | Critical | 9.8 | 2019-11-26 | Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'suffi… |
CVE-2011-4082 | High | 7.5 | 2019-11-26 | A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker… |
CVE-2011-3632 | High | 7.1 | 2019-11-26 | Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks. |
CVE-2011-3631 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calc… |
CVE-2011-3630 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A… |
CVE-2011-3617 | Medium | 6.5 | 2019-11-26 | Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases. |
CVE-2011-3596 | High | 7.5 | 2019-11-26 | Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. |
CVE-2011-3374 | Low | 3.7 | 2019-11-26 | It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. |
CVE-2012-6639 | High | 8.8 | 2019-11-25 | An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data. |
CVE-2019-19246 | High | 7.5 | 2019-11-25 | Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c. |
CVE-2015-1396 | High | 7.5 | 2019-11-25 | A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file… |
CVE-2012-5644 | Medium | 5.5 | 2019-11-25 | libuser has information disclosure when moving user's home directory |
CVE-2012-5521 | Medium | 6.5 | 2019-11-25 | quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal |
CVE-2019-11287 | High | 7.5 | 2019-11-23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versio… |
CVE-2014-6311 | Critical | 9.8 | 2019-11-22 | generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges. |
CVE-2014-6310 | Critical | 9.8 | 2019-11-22 | Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function. |
CVE-2019-18610 | High | 8.8 | 2019-11-22 | An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Aste… |
CVE-2019-18976 | High | 7.5 | 2019-11-22 | An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38… |
CVE-2019-18790 | Medium | 6.5 | 2019-11-22 | An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.2… |
CVE-2012-0812 | Medium | 6.1 | 2019-11-22 | PostfixAdmin 2.3.4 has multiple XSS vulnerabilities |
CVE-2015-7810 | Medium | 4.7 | 2019-11-22 | libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files |
CVE-2015-5694 | Medium | 6.5 | 2019-11-22 | Designate does not enforce the DNS protocol limit concerning record set sizes |
CVE-2019-10206 | Medium | 6.5 | 2019-11-22 | ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding… |
CVE-2019-19221 | Medium | 5.5 | 2019-11-21 | In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example… |
CVE-2014-5255 | High | 7.0 | 2019-11-21 | xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different… |
CVE-2019-19204 | High | 7.5 | 2019-11-21 | An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c… |
CVE-2019-18890 | Medium | 6.5 | 2019-11-21 | A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query. |
CVE-2019-5087 | High | 8.8 | 2019-11-21 | An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.0.7. An integer ove… |
CVE-2019-5086 | High | 8.8 | 2019-11-21 | An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, version 1.0.7. An in… |
CVE-2014-1936 | High | 7.5 | 2019-11-21 | rc before 1.7.1-5 insecurely creates temporary files. |
CVE-2014-1935 | Medium | 5.3 | 2019-11-21 | 9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames. |
CVE-2014-0083 | Medium | 5.5 | 2019-11-21 | The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords. |
CVE-2012-3543 | High | 7.5 | 2019-11-21 | mono 2.10.x ASP.NET Web Form Hash collision DoS |
CVE-2012-2350 | High | 7.5 | 2019-11-21 | pam_shield before 0.9.4: Default configuration does not perform protective action |
CVE-2019-19039 | Medium | 5.5 | 2019-11-21 | __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to o… |
CVE-2015-3167 | High | 7.5 | 2019-11-20 | contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error respons… |
CVE-2015-3166 | Critical | 9.8 | 2019-11-20 | The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly… |
CVE-2013-1817 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. |
CVE-2013-1816 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted reques… |
CVE-2015-1606 | Medium | 5.5 | 2019-11-20 | The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use… |
CVE-2019-3466 | High | 7.8 | 2019-11-20 | The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which coul… |
CVE-2011-0529 | High | 7.5 | 2019-11-20 | Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP. |
CVE-2012-6136 | Medium | 5.5 | 2019-11-20 | tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes. |
CVE-2011-1028 | Critical | 9.8 | 2019-11-20 | The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_var… |
CVE-2019-19126 | Low | 3.3 | 2019-11-19 | On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program executio… |
CVE-2011-2924 | Medium | 5.5 | 2019-11-19 | foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enab… |
CVE-2011-2923 | Medium | 5.5 | 2019-11-19 | foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled… |
CVE-2016-1000236 | Medium | 4.4 | 2019-11-19 | Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used. |
CVE-2012-6071 | High | 7.5 | 2019-11-19 | nuSOAP before 0.7.3-5 does not properly check the hostname of a cert. |
CVE-2014-5439 | High | 7.8 | 2019-11-19 | Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX… |
CVE-2012-0843 | Medium | 5.5 | 2019-11-19 | uzbl: Information disclosure via world-readable cookies storage file |
CVE-2011-4968 | Medium | 4.8 | 2019-11-19 | nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM) |
CVE-2012-0842 | Medium | 5.5 | 2019-11-19 | surf: cookie jar has read access from other local user |
CVE-2019-10172 | High | 7.5 | 2019-11-18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus ja… |
CVE-2019-19074 | High | 7.5 | 2019-11-18 | A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of… |
CVE-2019-19068 | Medium | 4.6 | 2019-11-18 | A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows atta… |
CVE-2019-19066 | Medium | 4.7 | 2019-11-18 | A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of serv… |
CVE-2019-19062 | Medium | 4.7 | 2019-11-18 | A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (me… |
CVE-2019-19057 | Low | 3.3 | 2019-11-18 | Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers… |
CVE-2019-19056 | Medium | 4.7 | 2019-11-18 | A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attacker… |
CVE-2019-19052 | High | 7.5 | 2019-11-18 | A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (me… |
CVE-2019-19051 | Medium | 5.5 | 2019-11-18 | A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause… |
CVE-2019-19012 | Critical | 9.8 | 2019-11-17 | An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this… |
CVE-2011-2910 | Medium | 6.7 | 2019-11-15 | The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges… |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2011-0703 | Critical | 9.8 | 2019-11-15 | In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session. |
CVE-2016-5285 | High | 7.5 | 2019-11-15 | A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMAC… |
CVE-2014-0021 | High | 7.5 | 2019-11-15 | Chrony before 1.29.1 has traffic amplification in cmdmon protocol |
CVE-2013-7089 | High | 7.5 | 2019-11-15 | ClamAV before 0.97.7: dbg_printhex possible information leak |