Debian
Page 74 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6789 | Critical | 9.8 | 2018-02-08 | An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. Thi… |
CVE-2017-5133 | High | 8.8 | 2018-02-07 | Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and… |
CVE-2017-5132 | High | 8.8 | 2018-02-07 | Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2017-5131 | High | 8.8 | 2018-02-07 | An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, ak… |
CVE-2017-5130 | High | 8.8 | 2018-02-07 | An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to pot… |
CVE-2017-5129 | High | 8.8 | 2018-02-07 | A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HT… |
CVE-2017-5128 | High | 8.8 | 2018-02-07 | Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2017-5127 | High | 8.8 | 2018-02-07 | Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2017-5126 | High | 8.8 | 2018-02-07 | A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2017-5125 | High | 8.8 | 2018-02-07 | Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2017-5124 | Medium | 6.1 | 2018-02-07 | Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a… |
CVE-2017-15395 | Medium | 6.5 | 2018-02-07 | A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka… |
CVE-2017-15394 | Medium | 6.5 | 2018-02-07 | Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs… |
CVE-2017-15393 | High | 8.8 | 2018-02-07 | Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugg… |
CVE-2017-15392 | Medium | 4.3 | 2018-02-07 | Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap… |
CVE-2017-15391 | Medium | 6.5 | 2018-02-07 | Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation… |
CVE-2017-15390 | Medium | 6.5 | 2018-02-07 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a… |
CVE-2017-15389 | Medium | 6.5 | 2018-02-07 | An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2017-15388 | High | 8.8 | 2018-02-07 | Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a craf… |
CVE-2017-15387 | High | 8.8 | 2018-02-07 | Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows w… |
CVE-2017-15386 | Medium | 6.5 | 2018-02-07 | Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6574 | High | 7.8 | 2018-02-07 | Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leverag… |
CVE-2018-6799 | High | 8.8 | 2018-02-07 | The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or… |
CVE-2018-6794 | Medium | 5.3 | 2018-02-07 | Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends… |
CVE-2018-6791 | Medium | 6.8 | 2018-02-07 | An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its v… |
CVE-2018-6767 | High | 7.8 | 2018-02-06 | A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service… |
CVE-2017-7525 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform… |
CVE-2017-15095 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code ex… |
CVE-2018-6621 | Medium | 6.5 | 2018-02-05 | The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a craft… |
CVE-2018-6616 | Medium | 5.5 | 2018-02-04 | In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to caus… |
CVE-2018-6596 | Critical | 9.1 | 2018-02-03 | webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remot… |
CVE-2018-6594 | High | 7.5 | 2018-02-03 | lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by read… |
CVE-2017-18123 | High | 8.6 | 2018-02-03 | The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerabi… |
CVE-2017-18122 | High | 8.1 | 2018-02-02 | A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any u… |
CVE-2017-18121 | Medium | 6.1 | 2018-02-02 | The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute… |
CVE-2018-6544 | Medium | 5.5 | 2018-02-02 | pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows rem… |
CVE-2018-6521 | Critical | 9.8 | 2018-02-02 | The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might… |
CVE-2018-6519 | High | 7.5 | 2018-02-02 | The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-… |
CVE-2017-18043 | Medium | 5.5 | 2018-01-31 | Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash). |
CVE-2018-5996 | High | 7.8 | 2018-01-31 | Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within t… |
CVE-2017-15698 | Medium | 5.9 | 2018-01-31 | When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fiel… |
CVE-2011-2902 | Medium | 5.3 | 2018-01-30 | zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows… |
CVE-2017-17969 | High | 7.8 | 2018-01-30 | Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of se… |
CVE-2016-10711 | Critical | 9.8 | 2018-01-29 | Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. |
CVE-2018-6392 | Medium | 6.5 | 2018-01-29 | The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via… |
CVE-2017-18078 | High | 7.8 | 2018-01-29 | systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned… |
CVE-2018-6360 | High | 8.8 | 2018-01-28 | mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and acc… |
CVE-2018-6359 | High | 8.8 | 2018-01-27 | The decompileIF function (util/decompile.c) in libming through 0.4.8 is vulnerable to a use-after-free, which may allow attackers to cause a denial of service… |
CVE-2018-6358 | High | 8.8 | 2018-01-27 | The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attackers to cause a den… |
CVE-2017-12380 | High | 7.5 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12379 | Critical | 9.8 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12378 | Medium | 5.5 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12377 | Critical | 9.8 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12376 | High | 7.8 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12375 | High | 7.5 | 2018-01-26 | The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of servi… |
CVE-2017-12374 | High | 7.5 | 2018-01-26 | The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of servi… |
CVE-2018-5750 | Medium | 5.5 | 2018-01-26 | The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by readin… |
CVE-2017-18076 | High | 7.5 | 2018-01-26 | In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the se… |
CVE-2018-6315 | High | 8.8 | 2018-01-25 | The outputSWF_TEXT_RECORD function (util/outputscript.c) in libming through 0.4.8 is vulnerable to an integer overflow and resultant out-of-bounds read, which… |
CVE-2017-15132 | High | 7.5 | 2018-01-25 | A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login process… |
CVE-2018-5748 | High | 7.5 | 2018-01-25 | qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. |
CVE-2018-1000007 | Critical | 9.8 | 2018-01-24 | libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will s… |
CVE-2018-1000005 | Critical | 9.1 | 2018-01-24 | libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) t… |
CVE-2018-6192 | Medium | 5.5 | 2018-01-24 | In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation violation and appl… |
CVE-2017-12187 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbi… |
CVE-2017-12186 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12185 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly ex… |
CVE-2017-12184 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute ar… |
CVE-2017-12183 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbi… |
CVE-2017-12182 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12181 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12180 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly exec… |
CVE-2017-12179 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to c… |
CVE-2017-12178 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly… |
CVE-2017-12177 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or pos… |
CVE-2017-12176 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or… |
CVE-2018-6187 | Medium | 5.5 | 2018-01-24 | In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackers… |
CVE-2018-5683 | Medium | 6.0 | 2018-01-23 | The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveragin… |
CVE-2017-18030 | Medium | 4.4 | 2018-01-23 | The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds arr… |
CVE-2018-5950 | Medium | 6.1 | 2018-01-23 | Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-optio… |
CVE-2017-15105 | Medium | 5.3 | 2018-01-23 | A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to pro… |
CVE-2018-6003 | High | 7.5 | 2018-01-22 | An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stac… |
CVE-2018-5968 | High | 8.1 | 2018-01-22 | FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-75… |
CVE-2016-10708 | High | 7.5 | 2018-01-21 | sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS mess… |
CVE-2017-15108 | High | 7.8 | 2018-01-20 | spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session th… |
CVE-2018-5786 | Medium | 5.5 | 2018-01-19 | In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip.c). Remote attackers could leverage thi… |
CVE-2018-5785 | Medium | 6.5 | 2018-01-19 | In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers c… |
CVE-2018-5784 | Medium | 6.5 | 2018-01-19 | In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerabili… |
CVE-2017-12197 | Medium | 6.5 | 2018-01-18 | It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled acc… |
CVE-2018-2678 | Medium | 4.3 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u1… |
CVE-2018-2677 | Medium | 4.3 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161… |
CVE-2018-2668 | Medium | 6.5 | 2018-01-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.3… |
CVE-2018-2665 | Medium | 6.5 | 2018-01-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.3… |
CVE-2018-2663 | Medium | 4.3 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE… |
CVE-2018-2641 | Medium | 6.1 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161… |
CVE-2018-2640 | Medium | 6.5 | 2018-01-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.3… |
CVE-2018-2637 | High | 7.4 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u17… |
CVE-2018-2634 | Medium | 6.8 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE: 7u161, 8u152… |
CVE-2018-2633 | High | 8.3 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u1… |
CVE-2018-2629 | Medium | 5.3 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE: 6u1… |