Debian
Page 56 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11730 | Medium | 6.5 | 2019-07-23 | A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directo… |
CVE-2019-11717 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible… |
CVE-2019-11711 | High | 8.8 | 2019-07-23 | When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperative… |
CVE-2019-11709 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory c… |
CVE-2019-9959 | Medium | 6.5 | 2019-07-22 | The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making i… |
CVE-2019-12815 | Critical | 9.8 | 2019-07-19 | An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a… |
CVE-2019-1010238 | Critical | 9.8 | 2019-07-19 | Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is… |
CVE-2019-13962 | Critical | 9.8 | 2019-07-18 | lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly val… |
CVE-2019-1010065 | Medium | 6.5 | 2019-07-18 | The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The compo… |
CVE-2019-1010069 | Medium | 5.5 | 2019-07-18 | moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The c… |
CVE-2019-13619 | High | 7.5 | 2019-07-17 | In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c… |
CVE-2019-13626 | Medium | 6.5 | 2019-07-17 | SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode()… |
CVE-2019-13272 | High | 7.8 | 2019-07-17 | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relati… |
CVE-2019-9849 | Medium | 4.3 | 2019-07-17 | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default… |
CVE-2019-9848 | Critical | 9.8 | 2019-07-17 | LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffic… |
CVE-2019-13115 | High | 8.1 | 2019-07-16 | In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read… |
CVE-2019-13616 | High | 8.1 | 2019-07-16 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_So… |
CVE-2019-1010057 | High | 7.8 | 2019-07-16 | nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The componen… |
CVE-2019-1010302 | Medium | 5.5 | 2019-07-15 | jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the… |
CVE-2019-1010301 | Medium | 5.5 | 2019-07-15 | jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open… |
CVE-2019-1010305 | Medium | 5.5 | 2019-07-15 | libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file l… |
CVE-2019-1010006 | High | 7.8 | 2019-07-15 | Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector i… |
CVE-2019-13602 | High | 7.8 | 2019-07-14 | An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial… |
CVE-2019-13161 | Medium | 5.3 | 2019-07-12 | An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-ce… |
CVE-2019-13574 | High | 7.8 | 2019-07-12 | In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is direct… |
CVE-2019-1010319 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-1010317 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-1010315 | Medium | 5.5 | 2019-07-11 | WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to par… |
CVE-2019-0053 | High | 7.8 | 2019-07-11 | Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to… |
CVE-2019-12529 | Medium | 5.9 | 2019-07-11 | An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Pr… |
CVE-2019-12527 | High | 8.8 | 2019-07-11 | An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decod… |
CVE-2019-12525 | Critical | 9.8 | 2019-07-11 | An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Au… |
CVE-2019-10193 | High | 7.2 | 2019-07-11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By… |
CVE-2019-10192 | High | 7.2 | 2019-07-11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By c… |
CVE-2019-12838 | Critical | 9.8 | 2019-07-11 | SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection. |
CVE-2019-13504 | Medium | 6.5 | 2019-07-11 | There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2. |
CVE-2019-13132 | Critical | 9.8 | 2019-07-10 | In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a… |
CVE-2019-12470 | Medium | 6.5 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12469 | Medium | 6.5 | 2019-07-10 | MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12474 | High | 7.5 | 2019-07-10 | Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cach… |
CVE-2019-12473 | High | 7.5 | 2019-07-10 | Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in… |
CVE-2019-12471 | Medium | 6.1 | 2019-07-10 | Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on… |
CVE-2019-12466 | High | 8.8 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 allows CSRF. |
CVE-2019-12468 | Critical | 9.8 | 2019-07-10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypas… |
CVE-2019-12467 | Medium | 5.3 | 2019-07-10 | MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability t… |
CVE-2019-13224 | Critical | 9.8 | 2019-07-10 | A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possib… |
CVE-2019-13454 | Medium | 6.5 | 2019-07-09 | ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. |
CVE-2018-11563 | Medium | 4.6 | 2019-07-08 | An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary s… |
CVE-2019-13345 | Medium | 6.1 | 2019-07-05 | The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. |
CVE-2019-13311 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error. |
CVE-2019-13309 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation… |
CVE-2019-13308 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage. |
CVE-2019-13307 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows. |
CVE-2019-13306 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors. |
CVE-2019-13305 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. |
CVE-2019-13304 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment. |
CVE-2019-13301 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error. |
CVE-2019-13300 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. |
CVE-2019-13297 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled. |
CVE-2019-13295 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled. |
CVE-2019-13232 | Low | 3.3 | 2019-07-04 | Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" iss… |
CVE-2019-5052 | High | 8.8 | 2019-07-03 | An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resul… |
CVE-2019-5051 | High | 8.8 | 2019-07-03 | An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buff… |
CVE-2019-7165 | Critical | 9.8 | 2019-07-03 | A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code. |
CVE-2019-13164 | High | 7.8 | 2019-07-03 | qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the… |
CVE-2019-12594 | Critical | 9.8 | 2019-07-02 | DOSBox 0.74-2 has Incorrect Access Control. |
CVE-2019-13147 | Medium | 6.5 | 2019-07-02 | In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attack… |
CVE-2019-13137 | Medium | 6.5 | 2019-07-01 | ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c. |
CVE-2019-13135 | High | 8.8 | 2019-07-01 | ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c. |
CVE-2019-12781 | Medium | 5.3 | 2019-07-01 | An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROX… |
CVE-2019-13117 | Medium | 5.3 | 2019-07-01 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow… |
CVE-2019-13114 | Medium | 6.5 | 2019-06-30 | http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted res… |
CVE-2019-13112 | Medium | 6.5 | 2019-06-30 | A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_… |
CVE-2019-13110 | Medium | 6.5 | 2019-06-30 | A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a… |
CVE-2019-13031 | High | 8.1 | 2019-06-28 | LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification serv… |
CVE-2019-5840 | Medium | 4.3 | 2019-06-27 | Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2019-5839 | Medium | 4.3 | 2019-06-27 | Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website… |
CVE-2019-5838 | Medium | 4.3 | 2019-06-27 | Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extens… |
CVE-2019-5837 | Medium | 6.5 | 2019-06-27 | Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5836 | High | 8.8 | 2019-06-27 | Heap buffer overflow in ANGLE in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5834 | Medium | 6.5 | 2019-06-27 | Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-5833 | Medium | 4.3 | 2019-06-27 | Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a cra… |
CVE-2019-5832 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2019-5831 | High | 8.8 | 2019-06-27 | Object lifecycle issue in V8 in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5830 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in CORS in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5829 | High | 8.8 | 2019-06-27 | Integer overflow in download manager in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2019-5828 | High | 8.8 | 2019-06-27 | Object lifecycle issue in ServiceWorker in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2019-5827 | High | 8.8 | 2019-06-27 | Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2019-5824 | High | 8.8 | 2019-06-27 | Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2019-5823 | Medium | 5.4 | 2019-06-27 | Insufficient policy enforcement in service workers in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass navigation restrictions via a cr… |
CVE-2019-5822 | High | 8.8 | 2019-06-27 | Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page. |
CVE-2019-5821 | High | 8.8 | 2019-06-27 | Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5820 | High | 8.8 | 2019-06-27 | Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5819 | High | 7.8 | 2019-06-27 | Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafte… |
CVE-2019-5818 | Medium | 6.5 | 2019-06-27 | Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-5817 | High | 8.8 | 2019-06-27 | Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2019-5814 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5813 | High | 8.8 | 2019-06-27 | Use after free in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5811 | High | 8.8 | 2019-06-27 | Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML p… |
CVE-2019-5810 | Medium | 6.5 | 2019-06-27 | Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory… |