Debian
Page 54 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14461 | High | 7.5 | 2019-10-03 | The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print(). |
CVE-2019-16943 | Critical | 9.8 | 2019-10-01 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific… |
CVE-2019-16942 | Critical | 9.8 | 2019-10-01 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific… |
CVE-2019-17055 | Low | 3.3 | 2019-10-01 | base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that… |
CVE-2019-17052 | Low | 3.3 | 2019-10-01 | ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivile… |
CVE-2019-16276 | High | 7.5 | 2019-09-30 | Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. |
CVE-2019-16993 | High | 8.8 | 2019-09-30 | In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An ac… |
CVE-2019-16935 | Medium | 6.1 | 2019-09-28 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/Do… |
CVE-2019-16928 | Critical | 9.8 | 2019-09-27 | Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat i… |
CVE-2019-9433 | Medium | 6.5 | 2019-09-27 | In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional exe… |
CVE-2019-9371 | Medium | 6.5 | 2019-09-27 | In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution p… |
CVE-2019-9325 | Medium | 6.5 | 2019-09-27 | In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution… |
CVE-2019-9278 | High | 8.8 | 2019-09-27 | In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider… |
CVE-2019-9232 | High | 7.5 | 2019-09-27 | In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution… |
CVE-2019-8075 | High | 7.5 | 2019-09-27 | Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability. Successful exploitation could lead to Information Di… |
CVE-2019-16869 | High | 7.5 | 2019-09-26 | Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request sm… |
CVE-2019-10092 | Medium | 6.1 | 2019-09-26 | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on t… |
CVE-2019-16910 | Medium | 5.3 | 2019-09-26 | Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which migh… |
CVE-2019-16738 | Medium | 5.3 | 2019-09-26 | In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. |
CVE-2017-18635 | Medium | 6.1 | 2019-09-25 | An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages p… |
CVE-2019-15941 | Critical | 9.8 | 2019-09-25 | OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization reques… |
CVE-2019-13627 | Medium | 6.3 | 2019-09-25 | It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4… |
CVE-2019-5094 | High | 7.5 | 2019-09-24 | An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-… |
CVE-2019-12068 | Low | 3.8 | 2019-09-24 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing scrip… |
CVE-2019-16746 | Critical | 9.8 | 2019-09-24 | An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leadi… |
CVE-2019-16729 | High | 7.8 | 2019-09-24 | pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain… |
CVE-2019-16728 | Medium | 6.1 | 2019-09-24 | DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari. |
CVE-2019-16713 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c. |
CVE-2019-16711 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. |
CVE-2019-16710 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c. |
CVE-2019-16708 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. |
CVE-2019-16680 | Medium | 4.3 | 2019-09-21 | An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwr… |
CVE-2019-14816 | High | 7.8 | 2019-09-20 | There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to c… |
CVE-2019-14814 | High | 7.8 | 2019-09-20 | There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local user… |
CVE-2019-14821 | High | 8.8 | 2019-09-19 | An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO w… |
CVE-2019-11779 | Medium | 6.5 | 2019-09-19 | In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or m… |
CVE-2019-16394 | Medium | 5.3 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which… |
CVE-2019-16393 | Medium | 6.1 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character. |
CVE-2019-16392 | Medium | 6.1 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages. |
CVE-2019-16391 | Medium | 6.5 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is… |
CVE-2019-14835 | High | 7.8 | 2019-09-17 | A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, lo… |
CVE-2019-16378 | Critical | 9.8 | 2019-09-17 | OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applicatio… |
CVE-2019-16239 | Critical | 9.8 | 2019-09-17 | process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes. |
CVE-2019-5482 | Critical | 9.8 | 2019-09-16 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. |
CVE-2019-5481 | Critical | 9.8 | 2019-09-16 | Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. |
CVE-2018-21016 | Medium | 6.5 | 2019-09-16 | audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and app… |
CVE-2018-21015 | Medium | 6.5 | 2019-09-16 | AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash)… |
CVE-2019-16335 | Critical | 9.8 | 2019-09-15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different… |
CVE-2019-14540 | Critical | 9.8 | 2019-09-15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. |
CVE-2019-16319 | High | 7.5 | 2019-09-15 | In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-grypho… |
CVE-2019-16275 | Medium | 6.5 | 2019-09-12 | hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mi… |
CVE-2019-16237 | High | 7.5 | 2019-09-11 | Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. |
CVE-2019-16236 | High | 7.5 | 2019-09-11 | Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. |
CVE-2019-16235 | High | 7.5 | 2019-09-11 | Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala. |
CVE-2019-16223 | Medium | 5.4 | 2019-09-11 | WordPress before 5.2.3 allows XSS in post previews by authenticated users. |
CVE-2019-16222 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) atta… |
CVE-2019-16221 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows reflected XSS in the dashboard. |
CVE-2019-16220 | Medium | 6.1 | 2019-09-11 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provid… |
CVE-2019-16219 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows XSS in shortcode previews. |
CVE-2019-16218 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows XSS in stored comments. |
CVE-2019-16217 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. |
CVE-2019-16168 | Medium | 6.5 | 2019-09-09 | In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field… |
CVE-2019-16167 | Medium | 5.5 | 2019-09-09 | sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c. |
CVE-2019-16163 | High | 7.5 | 2019-09-09 | Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. |
CVE-2019-16159 | High | 7.5 | 2019-09-09 | BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative… |
CVE-2016-10937 | High | 7.5 | 2019-09-08 | IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate. |
CVE-2019-9445 | Medium | 4.4 | 2019-09-06 | In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with… |
CVE-2019-9854 | High | 7.8 | 2019-09-06 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc… |
CVE-2019-16056 | High | 7.5 | 2019-09-06 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addres… |
CVE-2019-14813 | Critical | 9.8 | 2019-09-06 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scr… |
CVE-2019-15846 | Critical | 9.8 | 2019-09-06 | Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. |
CVE-2019-15946 | Medium | 6.4 | 2019-09-05 | OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c. |
CVE-2019-15945 | Medium | 6.4 | 2019-09-05 | OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c. |
CVE-2019-15939 | Medium | 5.9 | 2019-09-05 | An issue was discovered in OpenCV 4.1.0. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp. |
CVE-2018-21010 | High | 8.8 | 2019-09-05 | OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c. |
CVE-2019-15926 | Critical | 9.1 | 2019-09-04 | An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_e… |
CVE-2019-15917 | High | 7.0 | 2019-09-04 | An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers… |
CVE-2019-15902 | Medium | 5.6 | 2019-09-04 | A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4… |
CVE-2019-15892 | High | 7.5 | 2019-09-03 | An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an a… |
CVE-2019-14817 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabl… |
CVE-2019-14811 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-10197 | Medium | 6.5 | 2019-09-03 | A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samb… |
CVE-2015-9383 | Medium | 6.5 | 2019-09-03 | FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c. |
CVE-2015-9382 | Medium | 6.5 | 2019-09-03 | FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. |
CVE-2015-9381 | High | 8.8 | 2019-09-03 | FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. |
CVE-2019-14970 | High | 7.8 | 2019-08-29 | A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv… |
CVE-2019-14778 | High | 7.8 | 2019-08-29 | The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
CVE-2019-14777 | High | 7.8 | 2019-08-29 | The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
CVE-2019-14776 | High | 7.8 | 2019-08-29 | A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file. |
CVE-2019-14534 | Medium | 5.5 | 2019-08-29 | In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service… |
CVE-2019-14533 | High | 7.8 | 2019-08-29 | The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
CVE-2019-15807 | Medium | 4.7 | 2019-08-29 | In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and de… |
CVE-2019-14535 | High | 7.8 | 2019-08-29 | A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a cra… |
CVE-2019-14498 | High | 7.8 | 2019-08-29 | A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted C… |
CVE-2019-14438 | High | 7.8 | 2019-08-29 | A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-base… |
CVE-2019-14437 | High | 7.8 | 2019-08-29 | The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buf… |
CVE-2019-11500 | Critical | 9.8 | 2019-08-29 | In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0'… |
CVE-2019-13486 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of expansion in svcstatus.c. |
CVE-2019-13485 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service parameter to history… |
CVE-2019-13484 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of expansion in appfeed.c. |