Debian
Page 72 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9258 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources. |
CVE-2018-9256 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in epan/dissectors/packet-lwapp.c by limiting the encapsul… |
CVE-2018-9251 | Medium | 5.3 | 2018-04-04 | The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted… |
CVE-2018-9240 | High | 7.5 | 2018-04-03 | ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial… |
CVE-2018-8780 | Critical | 9.1 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? method… |
CVE-2018-8779 | High | 7.5 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not… |
CVE-2018-8778 | High | 7.5 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to… |
CVE-2018-8777 | High | 7.5 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted… |
CVE-2018-6914 | High | 7.5 | 2018-04-03 | Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before… |
CVE-2017-17742 | Medium | 5.3 | 2018-04-03 | Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can in… |
CVE-2018-0493 | High | 7.2 | 2018-04-03 | remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash… |
CVE-2018-0492 | High | 7.0 | 2018-04-03 | Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation. |
CVE-2018-4117 | Medium | 6.5 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTune… |
CVE-2017-7000 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component… |
CVE-2018-7566 | High | 7.8 | 2018-03-30 | The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user. |
CVE-2018-9132 | Medium | 6.5 | 2018-03-30 | libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerability to cause a deni… |
CVE-2018-7600 | Critical | 9.8 | 2018-03-29 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affectin… |
CVE-2018-1064 | High | 7.5 | 2018-03-28 | libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now al… |
CVE-2017-11509 | High | 8.8 | 2018-03-28 | An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement. |
CVE-2018-1083 | High | 7.8 | 2018-03-28 | Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially cr… |
CVE-2018-0739 | Medium | 6.5 | 2018-03-27 | Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recu… |
CVE-2018-8048 | Medium | 6.1 | 2018-03-27 | In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment. |
CVE-2018-8764 | High | 8.8 | 2018-03-27 | Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it easier for remote att… |
CVE-2018-8763 | Medium | 6.1 | 2018-03-27 | Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template… |
CVE-2018-0202 | Medium | 5.5 | 2018-03-27 | clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on… |
CVE-2017-18249 | High | 7.0 | 2018-03-26 | The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denia… |
CVE-2018-1312 | Critical | 9.8 | 2018-03-26 | In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated u… |
CVE-2018-1303 | High | 7.5 | 2018-03-26 | A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to b… |
CVE-2018-1301 | Medium | 5.9 | 2018-03-26 | A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by r… |
CVE-2018-1283 | Medium | 5.3 | 2018-03-26 | In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user… |
CVE-2017-15715 | High | 8.1 | 2018-03-26 | In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching… |
CVE-2017-15710 | High | 7.5 | 2018-03-26 | In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language hea… |
CVE-2018-9018 | Medium | 6.5 | 2018-03-25 | In GraphicsMagick 1.3.28, there is a divide-by-zero in the ReadMNGImage function of coders/png.c. Remote attackers could leverage this vulnerability to cause a… |
CVE-2018-9009 | High | 8.8 | 2018-03-25 | In libming 0.4.8, there is a use-after-free in the decompileJUMP function of the decompile.c file. |
CVE-2018-8976 | Medium | 6.5 | 2018-03-25 | In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted fil… |
CVE-2018-8971 | Critical | 9.8 | 2018-03-24 | The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing… |
CVE-2018-1000140 | Critical | 9.8 | 2018-03-23 | rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote… |
CVE-2018-8905 | High | 8.8 | 2018-03-22 | In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps. |
CVE-2018-3710 | High | 7.8 | 2018-03-21 | Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execu… |
CVE-2017-0926 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. |
CVE-2017-0925 | High | 7.2 | 2018-03-21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resultin… |
CVE-2017-0918 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution. |
CVE-2017-0917 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting. |
CVE-2017-0916 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote… |
CVE-2017-0915 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. |
CVE-2017-18241 | Medium | 5.5 | 2018-03-21 | fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge… |
CVE-2018-8828 | Critical | 9.8 | 2018-03-20 | A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malfor… |
CVE-2018-8822 | High | 7.8 | 2018-03-20 | Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/… |
CVE-2018-8754 | Medium | 5.5 | 2018-03-18 | The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user S… |
CVE-2018-8741 | High | 8.8 | 2018-03-17 | A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related… |
CVE-2018-8740 | High | 7.5 | 2018-03-17 | In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and… |
CVE-2018-1068 | Medium | 6.7 | 2018-03-16 | A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a li… |
CVE-2018-7033 | Critical | 9.8 | 2018-03-15 | SchedMD Slurm before 17.02.10 and 17.11.x before 17.11.5 allows SQL Injection attacks against SlurmDBD. |
CVE-2017-18238 | Medium | 5.5 | 2018-03-15 | An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp allows rem… |
CVE-2017-18236 | Medium | 5.5 | 2018-03-15 | An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attac… |
CVE-2017-18234 | High | 7.8 | 2018-03-15 | An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possi… |
CVE-2017-18233 | Medium | 5.5 | 2018-03-15 | An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause… |
CVE-2018-1000122 | Critical | 9.1 | 2018-03-14 | A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or inf… |
CVE-2018-1000121 | High | 7.5 | 2018-03-14 | A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service |
CVE-2018-1000120 | Critical | 9.8 | 2018-03-14 | A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. |
CVE-2018-1000132 | Critical | 9.1 | 2018-03-14 | Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. T… |
CVE-2017-18231 | Medium | 6.5 | 2018-03-14 | An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadEnhMetaFile in coders/emf.c, which all… |
CVE-2017-18230 | Medium | 6.5 | 2018-03-14 | An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadCINEONImage in coders/cineon.c, which… |
CVE-2017-18229 | Medium | 6.5 | 2018-03-14 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows at… |
CVE-2018-8099 | Medium | 6.5 | 2018-03-14 | Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a… |
CVE-2018-8098 | Medium | 6.5 | 2018-03-14 | Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a de… |
CVE-2018-1000127 | High | 7.5 | 2018-03-13 | memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to ite… |
CVE-2018-7750 | Critical | 9.8 | 2018-03-13 | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3… |
CVE-2018-1057 | High | 8.8 | 2018-03-13 | On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authent… |
CVE-2018-1050 | Medium | 4.3 | 2018-03-13 | All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemo… |
CVE-2018-1000085 | Medium | 5.5 | 2018-03-13 | ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of me… |
CVE-2018-1000078 | Medium | 6.1 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000077 | Medium | 5.3 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000076 | Critical | 9.8 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000075 | High | 7.5 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000069 | Medium | 5.5 | 2018-03-13 | FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from vi… |
CVE-2018-8087 | Medium | 5.5 | 2018-03-13 | Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.15.9 allows local users to cause a denial… |
CVE-2018-1000099 | High | 7.5 | 2018-03-13 | Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attac… |
CVE-2018-1000098 | High | 7.5 | 2018-03-13 | Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be explo… |
CVE-2018-1000097 | High | 7.8 | 2018-03-13 | Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function lo… |
CVE-2017-2619 | High | 7.5 | 2018-03-12 | Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not… |
CVE-2016-5314 | High | 8.8 | 2018-03-12 | Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application… |
CVE-2014-8129 | High | 8.8 | 2018-03-12 | LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as… |
CVE-2018-7537 | Medium | 5.3 | 2018-03-09 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods we… |
CVE-2018-7536 | Medium | 5.3 | 2018-03-09 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to e… |
CVE-2016-9591 | Medium | 5.5 | 2018-03-09 | JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application usin… |
CVE-2018-7998 | High | 7.5 | 2018-03-09 | In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote atta… |
CVE-2018-7995 | Medium | 4.7 | 2018-03-09 | Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a de… |
CVE-2018-1071 | Medium | 5.5 | 2018-03-09 | zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denia… |
CVE-2018-7877 | Medium | 6.5 | 2018-03-08 | There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for DOUBLE data. A Crafted input will lead to a denial of… |
CVE-2018-7876 | Medium | 6.5 | 2018-03-08 | In libming 0.4.8, a memory exhaustion vulnerability was found in the function parseSWF_ACTIONRECORD in util/parser.c, which allows remote attackers to cause a… |
CVE-2018-7875 | Medium | 6.5 | 2018-03-08 | There is a heap-based buffer over-read in the getString function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. A Crafted input will lead to a denial… |
CVE-2018-7874 | Medium | 6.5 | 2018-03-08 | An invalid memory address dereference was discovered in strlenext in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and appli… |
CVE-2018-7873 | Medium | 6.5 | 2018-03-08 | There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for INTEGER data. A Crafted input will lead to a denial of… |
CVE-2018-7872 | Medium | 6.5 | 2018-03-08 | An invalid memory address dereference was discovered in the function getName in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmentation faul… |
CVE-2018-7871 | High | 8.8 | 2018-03-08 | There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT16 data. A crafted input will lead to a denial… |
CVE-2018-7870 | Medium | 6.5 | 2018-03-08 | An invalid memory address dereference was discovered in getString in util/decompile.c in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmenta… |
CVE-2018-7869 | High | 7.5 | 2018-03-08 | There is a memory leak triggered in the function dcinit of util/decompile.c in libming 0.4.8, which will lead to a denial of service attack. |
CVE-2018-7868 | Medium | 6.5 | 2018-03-08 | There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. A Crafted input will lead to a denial o… |
CVE-2018-7867 | Medium | 6.5 | 2018-03-08 | There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 during a RegisterNumber sprintf. A Crafted input will lead… |