Debian
Page 71 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12105 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier to a Mesh. A speci… |
CVE-2017-12104 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially crafted .blend fil… |
CVE-2017-12103 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specia… |
CVE-2017-12102 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend… |
CVE-2017-12101 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite v2.78c. A specially… |
CVE-2017-12100 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .bl… |
CVE-2017-12099 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A specially cra… |
CVE-2017-12086 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite. A specially crafted… |
CVE-2017-12082 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specia… |
CVE-2017-12081 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blen… |
CVE-2017-7651 | High | 7.5 | 2018-04-24 | In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can b… |
CVE-2018-10323 | Medium | 5.5 | 2018-04-24 | The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmap… |
CVE-2016-9601 | Medium | 5.3 | 2018-04-24 | ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is… |
CVE-2018-1106 | Medium | 5.5 | 2018-04-23 | An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local… |
CVE-2018-8781 | High | 7.8 | 2018-04-23 | The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability all… |
CVE-2017-17833 | Critical | 9.8 | 2018-04-23 | OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote c… |
CVE-2018-10289 | Medium | 5.5 | 2018-04-22 | In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary could leverage this vulnerability to ca… |
CVE-2017-2825 | High | 7.0 | 2018-04-20 | In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An atta… |
CVE-2014-10073 | High | 7.5 | 2018-04-20 | The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the web… |
CVE-2018-2819 | Medium | 6.5 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior… |
CVE-2018-2818 | Medium | 4.9 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.5.59 and… |
CVE-2018-2817 | Medium | 6.5 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and… |
CVE-2018-2815 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Jav… |
CVE-2018-2814 | High | 8.3 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u181, 7u… |
CVE-2018-2813 | Medium | 4.3 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and… |
CVE-2018-2800 | Medium | 4.2 | 2018-04-19 | Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162… |
CVE-2018-2799 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u1… |
CVE-2018-2798 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u18… |
CVE-2018-2797 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u18… |
CVE-2018-2796 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java… |
CVE-2018-2795 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE… |
CVE-2018-2794 | High | 7.7 | 2018-04-19 | Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u1… |
CVE-2018-2790 | Low | 3.1 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7… |
CVE-2018-2784 | Medium | 6.5 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.39 and prior and 5.7.21 and pr… |
CVE-2018-2782 | Medium | 6.5 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.39 and prior and 5.7.21 and pr… |
CVE-2018-2781 | Medium | 4.9 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.59 and prior, 5.6.3… |
CVE-2018-2773 | Medium | 4.1 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39… |
CVE-2018-2771 | Medium | 4.4 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Locking). Supported versions that are affected are 5.5.59 and prior, 5.6.39… |
CVE-2018-2766 | Medium | 4.9 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.39 and prior and 5.7.21 and pr… |
CVE-2018-2761 | Medium | 5.9 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39… |
CVE-2018-2755 | High | 7.7 | 2018-04-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.59 and prior, 5.6… |
CVE-2018-10194 | High | 7.8 | 2018-04-18 | The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-po… |
CVE-2018-1000164 | High | 7.5 | 2018-04-18 | gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/… |
CVE-2018-1088 | High | 8.1 | 2018-04-18 | A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster st… |
CVE-2018-10191 | Critical | 9.8 | 2018-04-17 | In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope n… |
CVE-2018-6913 | Critical | 9.8 | 2018-04-17 | Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count. |
CVE-2018-6798 | High | 7.5 | 2018-04-17 | An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potential… |
CVE-2018-6797 | Critical | 9.8 | 2018-04-17 | An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written. |
CVE-2018-10124 | Medium | 5.5 | 2018-04-16 | The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local u… |
CVE-2018-10120 | High | 7.8 | 2018-04-16 | The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations… |
CVE-2018-10119 | High | 7.8 | 2018-04-16 | sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows… |
CVE-2018-10102 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. |
CVE-2018-10101 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. |
CVE-2018-10100 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. |
CVE-2017-0372 | Critical | 9.8 | 2018-04-13 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. |
CVE-2017-0370 | Medium | 5.3 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter. |
CVE-2017-0369 | Medium | 6.5 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. |
CVE-2017-0368 | Medium | 5.3 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages. |
CVE-2017-0367 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is ins… |
CVE-2017-0366 | Medium | 5.4 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration. |
CVE-2017-0365 | Medium | 4.7 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. |
CVE-2017-0364 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link. |
CVE-2017-0363 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites. |
CVE-2017-0362 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. |
CVE-2017-0361 | High | 7.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext. |
CVE-2017-0359 | Critical | 9.8 | 2018-04-13 | diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive. |
CVE-2017-0358 | High | 7.8 | 2018-04-13 | Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elev… |
CVE-2017-0357 | Critical | 9.8 | 2018-04-13 | A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption. |
CVE-2017-0356 | Critical | 9.8 | 2018-04-13 | A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass… |
CVE-2016-9646 | Medium | 5.3 | 2018-04-13 | ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can… |
CVE-2018-10087 | Medium | 5.5 | 2018-04-13 | The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to c… |
CVE-2018-1084 | High | 7.5 | 2018-04-12 | corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c. |
CVE-2018-1086 | Medium | 4.3 | 2018-04-12 | pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debu… |
CVE-2018-10061 | Medium | 5.4 | 2018-04-12 | Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_escape function in lib… |
CVE-2018-10060 | Medium | 5.4 | 2018-04-12 | Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php. |
CVE-2018-10001 | Medium | 6.5 | 2018-04-11 | The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI… |
CVE-2018-3839 | High | 8.8 | 2018-04-10 | An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted X… |
CVE-2018-3838 | Medium | 6.5 | 2018-04-10 | An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF… |
CVE-2018-3837 | Medium | 5.5 | 2018-04-10 | An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially c… |
CVE-2018-9989 | High | 7.5 | 2018-04-10 | ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input. |
CVE-2018-9988 | High | 7.5 | 2018-04-10 | ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input. |
CVE-2017-2826 | Low | 3.7 | 2018-04-09 | An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zab… |
CVE-2018-1308 | High | 7.5 | 2018-04-09 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter… |
CVE-2018-9846 | High | 8.8 | 2018-04-07 | In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" par… |
CVE-2018-1270 | Critical | 9.8 | 2018-04-06 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocke… |
CVE-2018-1000156 | High | 7.8 | 2018-04-06 | GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can resul… |
CVE-2017-18257 | Medium | 5.5 | 2018-04-04 | The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow and loop) via… |
CVE-2017-13305 | High | 7.1 | 2018-04-04 | A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974. |
CVE-2018-9273 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak. |
CVE-2018-9270 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak. |
CVE-2018-9269 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak. |
CVE-2018-9268 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak. |
CVE-2018-9267 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-lapd.c has a memory leak. |
CVE-2018-9265 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-tn3270.c has a memory leak. |
CVE-2018-9264 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector could crash with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-… |
CVE-2018-9263 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. This was addressed in epan/dissectors/packet-kerberos.c by ensuring a nonz… |
CVE-2018-9262 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. This was addressed in epan/dissectors/packet-vlan.c by limiting VLAN tag nesti… |
CVE-2018-9261 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was address… |
CVE-2018-9260 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring… |
CVE-2018-9259 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash. This was addressed in epan/dissectors/file-mp4.c by restricting the box recursi… |