Debian
Page 52 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-7088 | Critical | 9.8 | 2019-11-15 | ClamAV before 0.97.7 has buffer overflow in the libclamav component |
CVE-2013-7087 | Critical | 9.8 | 2019-11-15 | ClamAV before 0.97.7 has WWPack corrupt heap memory |
CVE-2013-4584 | Medium | 5.9 | 2019-11-15 | Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers no… |
CVE-2019-18928 | Critical | 9.8 | 2019-11-15 | Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an… |
CVE-2019-18978 | Medium | 5.3 | 2019-11-14 | An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources be… |
CVE-2018-12207 | Medium | 6.5 | 2019-11-14 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentiall… |
CVE-2019-11139 | Medium | 6.0 | 2019-11-14 | Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable d… |
CVE-2019-11135 | Medium | 6.5 | 2019-11-14 | TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via… |
CVE-2012-1155 | High | 7.5 | 2019-11-14 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the… |
CVE-2011-1930 | Critical | 9.8 | 2019-11-14 | In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a… |
CVE-2011-1588 | High | 7.8 | 2019-11-14 | Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error. |
CVE-2011-1490 | Medium | 5.5 | 2019-11-14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches co… |
CVE-2011-1489 | Medium | 5.5 | 2019-11-14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches c… |
CVE-2011-1488 | Medium | 5.5 | 2019-11-14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker co… |
CVE-2011-1145 | High | 7.8 | 2019-11-14 | The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in t… |
CVE-2011-1136 | Medium | 4.7 | 2019-11-14 | In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. |
CVE-2011-1070 | High | 7.8 | 2019-11-14 | v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and pote… |
CVE-2011-0544 | Medium | 6.1 | 2019-11-14 | phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag. |
CVE-2010-5108 | High | 7.5 | 2019-11-13 | Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of… |
CVE-2010-4817 | Medium | 5.5 | 2019-11-13 | pithos before 0.3.5 allows overwrite of arbitrary files via symlinks. |
CVE-2010-4664 | High | 8.8 | 2019-11-13 | In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privilege… |
CVE-2010-4661 | High | 7.8 | 2019-11-13 | udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules. |
CVE-2010-4657 | High | 7.5 | 2019-11-13 | PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak in… |
CVE-2010-4654 | High | 7.8 | 2019-11-13 | poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack. |
CVE-2010-4653 | Medium | 6.5 | 2019-11-13 | An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts. |
CVE-2010-4533 | Critical | 9.8 | 2019-11-13 | offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with m… |
CVE-2010-4532 | Medium | 5.9 | 2019-11-13 | offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks. |
CVE-2012-4385 | Medium | 6.5 | 2019-11-13 | letodms 3.3.6 has CSRF via change password |
CVE-2012-4384 | Medium | 6.1 | 2019-11-13 | letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar |
CVE-2019-18397 | High | 7.8 | 2019-11-13 | A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial… |
CVE-2010-3844 | High | 8.8 | 2019-11-12 | An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack. |
CVE-2010-3440 | Medium | 5.5 | 2019-11-12 | babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwr… |
CVE-2010-3299 | Medium | 6.5 | 2019-11-12 | The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks. |
CVE-2010-3439 | Medium | 6.5 | 2019-11-12 | It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command. |
CVE-2010-3438 | Critical | 9.8 | 2019-11-12 | libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argume… |
CVE-2010-3359 | Medium | 4.8 | 2019-11-12 | If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick anot… |
CVE-2012-1572 | High | 7.5 | 2019-11-12 | OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space |
CVE-2019-18848 | High | 7.5 | 2019-11-12 | The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. |
CVE-2011-3618 | High | 7.8 | 2019-11-12 | atop: symlink attack possible due to insecure tempfile handling |
CVE-2011-2897 | Critical | 9.8 | 2019-11-12 | gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw |
CVE-2019-18849 | Medium | 5.5 | 2019-11-11 | In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/… |
CVE-2009-3614 | Low | 3.3 | 2019-11-09 | liboping 1.3.2 allows users reading arbitrary files upon the local system. |
CVE-2019-14824 | Medium | 6.5 | 2019-11-08 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this coul… |
CVE-2008-7291 | Critical | 9.8 | 2019-11-08 | gri before 2.12.18 generates temporary files in an insecure way. |
CVE-2013-1811 | Medium | 4.3 | 2019-11-07 | An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New". |
CVE-2013-1809 | High | 7.5 | 2019-11-07 | Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary direc… |
CVE-2007-6745 | Critical | 9.8 | 2019-11-07 | clamav 0.91.2 suffers from a floating point exception when using ScanOLE2. |
CVE-2013-1429 | Medium | 6.3 | 2019-11-07 | Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks. |
CVE-2007-5743 | High | 7.5 | 2019-11-07 | viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option. |
CVE-2013-1425 | Medium | 5.5 | 2019-11-07 | ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions. |
CVE-2010-2450 | High | 7.5 | 2019-11-07 | The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key… |
CVE-2019-3465 | High | 8.8 | 2019-11-07 | Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML… |
CVE-2012-0051 | High | 7.4 | 2019-11-07 | Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. |
CVE-2012-0049 | Medium | 4.3 | 2019-11-07 | OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server. |
CVE-2019-18809 | Medium | 4.6 | 2019-11-07 | A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denia… |
CVE-2019-18804 | High | 7.5 | 2019-11-07 | DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp. |
CVE-2009-5046 | Medium | 6.1 | 2019-11-06 | JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22. |
CVE-2009-5045 | High | 7.5 | 2019-11-06 | Dump Servlet information leak in jetty before 6.1.22. |
CVE-2009-5049 | Medium | 6.1 | 2019-11-06 | WebApp JSP Snoop page XSS in jetty though 6.1.21. |
CVE-2010-2471 | Medium | 6.1 | 2019-11-06 | Drupal versions 5.x and 6.x has open redirection |
CVE-2011-4900 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.5.4 allows Information Disclosure in the backend. |
CVE-2011-4625 | High | 7.5 | 2019-11-06 | simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. |
CVE-2007-0899 | Critical | 9.8 | 2019-11-06 | There is a possible heap overflow in libclamav/fsg.c before 0.100.0. |
CVE-2006-4245 | High | 8.1 | 2019-11-06 | archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition. |
CVE-2019-5068 | Medium | 4.4 | 2019-11-05 | An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared me… |
CVE-2013-5123 | Medium | 5.9 | 2019-11-05 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-… |
CVE-2010-3674 | Medium | 6.1 | 2019-11-05 | TYPO3 before 4.4.1 allows XSS in the frontend search box. |
CVE-2013-6275 | Medium | 6.5 | 2019-11-05 | Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php. |
CVE-2013-6461 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
CVE-2013-6460 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
CVE-2016-1000002 | Low | 2.4 | 2019-11-05 | gdm3 3.14.2 and possibly later has an information leak before screen lock |
CVE-2013-6365 | Medium | 5.3 | 2019-11-05 | Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions |
CVE-2013-6364 | High | 8.8 | 2019-11-05 | Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book |
CVE-2017-5333 | High | 7.8 | 2019-11-04 | Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of s… |
CVE-2017-5332 | High | 7.8 | 2019-11-04 | The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denia… |
CVE-2017-5331 | High | 7.8 | 2019-11-04 | Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash… |
CVE-2013-4251 | High | 7.8 | 2019-11-04 | The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. |
CVE-2005-4890 | High | 7.8 | 2019-11-04 | There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the paren… |
CVE-2019-18683 | High | 7.0 | 2019-11-04 | An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributio… |
CVE-2013-4412 | High | 7.5 | 2019-11-04 | slim has NULL pointer dereference when using crypt() method from glibc 2.17 |
CVE-2013-4168 | Medium | 6.1 | 2019-11-01 | Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields. |
CVE-2013-2255 | Medium | 5.9 | 2019-11-01 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. |
CVE-2005-2351 | Medium | 5.5 | 2019-11-01 | Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files. |
CVE-2013-2227 | High | 7.5 | 2019-11-01 | GLPI 0.83.7 has Local File Inclusion in common.tabs.php. |
CVE-2013-3718 | Medium | 5.5 | 2019-11-01 | evince is missing a check on number of pages which can lead to a segmentation fault |
CVE-2013-2739 | Critical | 9.8 | 2019-11-01 | MiniDLNA has heap-based buffer overflow |
CVE-2013-2600 | High | 7.5 | 2019-11-01 | MiniUPnPd has information disclosure use of snprintf() |
CVE-2019-5010 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate… |
CVE-2012-6123 | Medium | 6.5 | 2019-10-31 | Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack." |
CVE-2013-2024 | High | 8.8 | 2019-10-31 | OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. |
CVE-2013-2012 | High | 7.3 | 2019-10-31 | autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory. |
CVE-2013-1951 | Medium | 6.1 | 2019-10-31 | A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HT… |
CVE-2013-1934 | Medium | 5.4 | 2019-10-31 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authentica… |
CVE-2013-1910 | Critical | 9.8 | 2019-10-31 | yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse… |
CVE-2010-2490 | Medium | 6.5 | 2019-10-31 | Mumble: murmur-server has DoS due to malformed client query |
CVE-2009-5043 | Critical | 9.8 | 2019-10-31 | burn allows file names to escape via mishandled quotation marks |
CVE-2009-5042 | Critical | 9.1 | 2019-10-31 | python-docutils allows insecure usage of temporary files |
CVE-2009-5041 | Critical | 9.8 | 2019-10-31 | overkill has buffer overflow via long player names that can corrupt data on the server machine |
CVE-2019-18425 | Critical | 9.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missi… |
CVE-2019-18424 | Medium | 6.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a ph… |