Debian
Page 59 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-12393 | High | 7.5 | 2019-02-28 | A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could resu… |
CVE-2018-12392 | Critical | 9.8 | 2019-02-28 | When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor ev… |
CVE-2018-12390 | Critical | 9.8 | 2019-02-28 | Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory c… |
CVE-2018-12389 | High | 8.8 | 2019-02-28 | Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and w… |
CVE-2019-1999 | High | 7.8 | 2019-02-28 | In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege in the k… |
CVE-2019-9215 | Critical | 9.8 | 2019-02-28 | In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. |
CVE-2019-9214 | High | 7.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted… |
CVE-2019-9209 | Medium | 5.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preven… |
CVE-2019-9208 | High | 7.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL poin… |
CVE-2019-1559 | Medium | 5.9 | 2019-02-27 | If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can… |
CVE-2019-9210 | High | 7.8 | 2019-02-27 | In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to w… |
CVE-2019-9200 | High | 8.8 | 2019-02-26 | A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted… |
CVE-2019-9024 | High | 7.5 | 2019-02-22 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server… |
CVE-2019-9023 | Critical | 9.8 | 2019-02-22 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances… |
CVE-2019-9022 | High | 7.5 | 2019-02-22 | An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hosti… |
CVE-2019-9021 | Critical | 9.8 | 2019-02-22 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading fun… |
CVE-2019-9020 | Critical | 9.8 | 2019-02-22 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can… |
CVE-2019-8980 | High | 7.5 | 2019-02-21 | A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumpti… |
CVE-2018-5819 | High | 7.5 | 2019-02-20 | An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU re… |
CVE-2018-5818 | High | 7.5 | 2019-02-20 | An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop. |
CVE-2018-5817 | High | 7.5 | 2019-02-20 | A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited to trigger… |
CVE-2019-8942 | High | 8.8 | 2019-02-20 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, su… |
CVE-2019-7164 | Critical | 9.8 | 2019-02-20 | SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. |
CVE-2019-5783 | High | 8.8 | 2019-02-19 | Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection att… |
CVE-2019-5782 | High | 8.8 | 2019-02-19 | Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf… |
CVE-2019-5781 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5780 | High | 7.8 | 2019-02-19 | Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript… |
CVE-2019-5779 | Medium | 4.3 | 2019-02-19 | Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafte… |
CVE-2019-5778 | Medium | 6.5 | 2019-02-19 | A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced… |
CVE-2019-5777 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5776 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5775 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5774 | High | 8.8 | 2019-02-19 | Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who conv… |
CVE-2019-5773 | Medium | 6.5 | 2019-02-19 | Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2019-5772 | High | 8.8 | 2019-02-19 | Sharing of objects over calls into JavaScript runtime in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap co… |
CVE-2019-5770 | High | 8.8 | 2019-02-19 | Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory read via a crafted H… |
CVE-2019-5769 | High | 8.8 | 2019-02-19 | Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentia… |
CVE-2019-5768 | Medium | 6.5 | 2019-02-19 | DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to instal… |
CVE-2019-5767 | Medium | 6.5 | 2019-02-19 | Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a m… |
CVE-2019-5766 | Medium | 6.5 | 2019-02-19 | Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2019-5765 | Medium | 5.5 | 2019-02-19 | An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive informa… |
CVE-2019-5764 | High | 8.8 | 2019-02-19 | Incorrect pointer management in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2019-5763 | High | 8.8 | 2019-02-19 | Failure to check error conditions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2019-5762 | High | 8.8 | 2019-02-19 | Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sand… |
CVE-2019-5760 | High | 8.8 | 2019-02-19 | Insufficient checks of pointer validity in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2019-5759 | Critical | 9.6 | 2019-02-19 | Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform… |
CVE-2019-5758 | High | 8.8 | 2019-02-19 | Incorrect object lifecycle management in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a cr… |
CVE-2019-5757 | High | 8.8 | 2019-02-19 | An incorrect object type assumption in SVG in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit object corruption via a craf… |
CVE-2019-5756 | High | 8.8 | 2019-02-19 | Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sand… |
CVE-2019-5755 | High | 8.1 | 2019-02-19 | Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write via a crafted HTML p… |
CVE-2019-5754 | Medium | 6.5 | 2019-02-19 | Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cle… |
CVE-2019-8907 | High | 8.8 | 2019-02-18 | do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly… |
CVE-2019-8905 | Medium | 4.4 | 2019-02-18 | do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-103… |
CVE-2016-10742 | Medium | 6.1 | 2019-02-17 | Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request param… |
CVE-2019-8383 | High | 7.8 | 2019-02-17 | An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by se… |
CVE-2019-8379 | High | 7.8 | 2019-02-17 | An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be trigger… |
CVE-2019-8354 | Medium | 5.0 | 2019-02-15 | An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer… |
CVE-2019-6974 | High | 8.1 | 2019-02-15 | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-a… |
CVE-2019-8308 | High | 8.2 | 2019-02-12 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executabl… |
CVE-2018-15587 | Medium | 6.5 | 2019-02-11 | GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signat… |
CVE-2019-7665 | Medium | 5.5 | 2019-02-09 | In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a s… |
CVE-2019-7663 | Medium | 6.5 | 2019-02-09 | An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBuf… |
CVE-2019-7659 | High | 8.1 | 2019-02-09 | Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers to cause a denial of service (application abort) or possibly have unspecified other impact if a se… |
CVE-2019-7653 | Critical | 9.8 | 2019-02-09 | The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code in… |
CVE-2019-7638 | High | 8.8 | 2019-02-08 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c. |
CVE-2019-7637 | High | 8.8 | 2019-02-08 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c. |
CVE-2019-7636 | High | 8.1 | 2019-02-08 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c. |
CVE-2019-7635 | High | 8.1 | 2019-02-08 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. |
CVE-2019-7578 | High | 8.1 | 2019-02-07 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c. |
CVE-2019-7577 | High | 8.8 | 2019-02-07 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c. |
CVE-2019-7576 | High | 8.8 | 2019-02-07 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef… |
CVE-2019-7575 | High | 8.8 | 2019-02-07 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c. |
CVE-2019-7574 | High | 8.8 | 2019-02-07 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c. |
CVE-2019-7573 | High | 8.8 | 2019-02-07 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef… |
CVE-2019-7572 | High | 8.8 | 2019-02-07 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c. |
CVE-2018-20763 | High | 7.8 | 2019-02-06 | In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv b… |
CVE-2018-20762 | High | 7.8 | 2019-02-06 | GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used f… |
CVE-2018-20761 | High | 7.8 | 2019-02-06 | GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a. |
CVE-2018-20760 | High | 7.8 | 2019-02-06 | In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return val… |
CVE-2019-7548 | High | 7.8 | 2019-02-06 | SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. |
CVE-2019-3823 | Medium | 4.3 | 2019-02-06 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer pass… |
CVE-2019-3822 | Critical | 9.8 | 2019-02-06 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth… |
CVE-2018-16890 | High | 7.5 | 2019-02-06 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vaut… |
CVE-2019-3464 | Critical | 9.8 | 2019-02-06 | Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users t… |
CVE-2019-3463 | Critical | 9.8 | 2019-02-06 | Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform on… |
CVE-2018-18506 | Medium | 5.9 | 2019-02-05 | When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specif… |
CVE-2018-18505 | Critical | 10.0 | 2019-02-05 | An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server pa… |
CVE-2018-18501 | Critical | 9.8 | 2019-02-05 | Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory c… |
CVE-2018-18500 | Critical | 9.8 | 2019-02-05 | A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being fre… |
CVE-2018-8800 | Critical | 9.8 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_data() that results in a memory corruption and pro… |
CVE-2018-8799 | High | 7.5 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial of Service (segfault). |
CVE-2018-8798 | High | 7.5 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() that results in an information leak. |
CVE-2018-8797 | Critical | 9.8 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably… |
CVE-2018-8796 | High | 7.5 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of Service (segfault). |
CVE-2018-8795 | Critical | 9.8 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmap_updates() and re… |
CVE-2018-8794 | Critical | 9.8 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updates() and results… |
CVE-2018-8793 | Critical | 9.8 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and pro… |
CVE-2018-8792 | High | 7.5 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault). |
CVE-2018-8791 | High | 7.5 | 2019-02-05 | rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak. |
CVE-2018-4056 | Critical | 9.8 | 2019-02-05 | An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially… |