Debian
Page 75 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-2622 | Medium | 6.5 | 2018-01-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and… |
CVE-2018-2618 | Medium | 5.9 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u17… |
CVE-2018-2612 | Medium | 6.5 | 2018-01-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and pr… |
CVE-2018-2603 | Medium | 5.3 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE… |
CVE-2018-2602 | Medium | 4.5 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: I18n). Supported versions that are affected are Java SE: 6u171, 7u161… |
CVE-2018-2599 | Medium | 4.8 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u1… |
CVE-2018-2588 | Medium | 4.3 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: LDAP). Supported versions that are affected are Java SE: 6u1… |
CVE-2018-2582 | Medium | 6.5 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 8u152 and… |
CVE-2018-2579 | Low | 3.7 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE… |
CVE-2018-2562 | High | 7.1 | 2018-01-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5.58 and prior, 5.6… |
CVE-2018-5764 | High | 7.5 | 2018-01-17 | The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypas… |
CVE-2018-5747 | Medium | 5.5 | 2018-01-17 | In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers could leverage this vulnerability to ca… |
CVE-2018-5712 | Medium | 6.1 | 2018-01-16 | An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error pa… |
CVE-2018-5711 | Medium | 5.5 | 2018-01-16 | gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an inte… |
CVE-2018-5704 | Critical | 9.6 | 2018-01-16 | Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to condu… |
CVE-2018-5702 | High | 8.8 | 2018-01-15 | Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to… |
CVE-2018-5686 | Medium | 5.5 | 2018-01-14 | In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered… |
CVE-2018-5685 | Medium | 6.5 | 2018-01-14 | In GraphicsMagick 1.3.27, there is an infinite loop and application hang in the ReadBMPImage function (coders/bmp.c). Remote attackers could leverage this vuln… |
CVE-2018-0486 | Medium | 6.5 | 2018-01-13 | Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user… |
CVE-2017-13194 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6471… |
CVE-2018-5345 | High | 7.8 | 2018-01-12 | A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code… |
CVE-2018-5336 | High | 7.5 | 2018-01-11 | In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting th… |
CVE-2018-5335 | Medium | 6.5 | 2018-01-11 | In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available… |
CVE-2018-5334 | Medium | 6.5 | 2018-01-11 | In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timest… |
CVE-2018-5333 | Medium | 5.5 | 2018-01-11 | In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied… |
CVE-2018-5332 | High | 7.8 | 2018-01-11 | In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-base… |
CVE-2017-17485 | Critical | 9.8 | 2018-01-10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-75… |
CVE-2017-18026 | High | 8.8 | 2018-01-10 | Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows rem… |
CVE-2015-2320 | Critical | 9.8 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback. |
CVE-2015-2318 | High | 8.1 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging m… |
CVE-2018-5294 | Medium | 6.5 | 2018-01-08 | In libming 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the readUInt32 function (util/read.c). Remote attackers could leverage… |
CVE-2018-5269 | Medium | 5.5 | 2018-01-08 | In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast. |
CVE-2018-5268 | Medium | 5.5 | 2018-01-08 | In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted… |
CVE-2018-5208 | Critical | 9.8 | 2018-01-06 | In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings. |
CVE-2018-5207 | High | 7.5 | 2018-01-06 | When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string. |
CVE-2018-5206 | Critical | 9.8 | 2018-01-06 | When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer. |
CVE-2018-5205 | High | 7.5 | 2018-01-06 | When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string. |
CVE-2018-5251 | Medium | 6.5 | 2018-01-05 | In libming 0.4.8, there is an integer signedness error vulnerability (left shift of a negative value) in the readSBits function (util/read.c). Remote attackers… |
CVE-2018-5248 | High | 8.8 | 2018-01-05 | In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function. |
CVE-2017-1665 | Medium | 5.9 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2017-5753 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local u… |
CVE-2017-5715 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker wit… |
CVE-2017-1000487 | Critical | 9.8 | 2018-01-03 | Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings. |
CVE-2017-1000472 | Medium | 6.5 | 2018-01-03 | The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header… |
CVE-2017-1000476 | Medium | 6.5 | 2018-01-03 | ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of ser… |
CVE-2017-1000501 | Critical | 9.8 | 2018-01-03 | Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated re… |
CVE-2017-18017 | Critical | 9.8 | 2018-01-03 | The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a den… |
CVE-2017-1000433 | High | 8.1 | 2018-01-02 | pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing the… |
CVE-2017-1000422 | High | 8.8 | 2018-01-02 | Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execu… |
CVE-2017-1000421 | Critical | 9.8 | 2018-01-02 | Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution |
CVE-2017-1000456 | High | 8.8 | 2018-01-02 | freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations. |
CVE-2017-1000450 | High | 8.8 | 2018-01-02 | In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the ima… |
CVE-2017-1000445 | Medium | 6.5 | 2018-01-02 | ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore component and might lead to denial of service |
CVE-2017-18005 | Medium | 5.5 | 2017-12-31 | Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file. |
CVE-2017-17997 | High | 7.5 | 2017-12-30 | In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv… |
CVE-2017-17760 | Medium | 6.5 | 2017-12-29 | OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used. |
CVE-2014-4914 | Critical | 9.8 | 2017-12-29 | The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection… |
CVE-2017-17935 | High | 7.5 | 2017-12-27 | The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to ca… |
CVE-2017-17915 | High | 8.8 | 2017-12-27 | In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testin… |
CVE-2017-17914 | Medium | 6.5 | 2017-12-27 | In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service (Re… |
CVE-2017-17913 | High | 8.8 | 2017-12-27 | In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to an incompatibility with libw… |
CVE-2017-17912 | High | 8.8 | 2017-12-27 | In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data… |
CVE-2017-17879 | High | 8.8 | 2017-12-27 | In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and cau… |
CVE-2017-17866 | High | 7.8 | 2017-12-27 | pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote a… |
CVE-2017-17864 | Low | 3.3 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, whi… |
CVE-2017-17863 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local use… |
CVE-2017-17862 | Medium | 5.5 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, als… |
CVE-2017-17857 | High | 7.8 | 2017-12-27 | The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruptio… |
CVE-2017-17856 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other… |
CVE-2017-17855 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other… |
CVE-2017-17854 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly h… |
CVE-2017-17853 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other… |
CVE-2017-17852 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other… |
CVE-2017-17848 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signe… |
CVE-2017-17847 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature… |
CVE-2017-17846 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long stri… |
CVE-2017-17845 | High | 7.3 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-… |
CVE-2017-17844 | Medium | 6.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot d… |
CVE-2017-17843 | Medium | 5.9 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regula… |
CVE-2017-16996 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other… |
CVE-2017-16995 | High | 7.8 | 2017-12-27 | The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possi… |
CVE-2017-17806 | High | 7.8 | 2017-12-20 | The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowi… |
CVE-2017-17805 | High | 7.8 | 2017-12-20 | The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_A… |
CVE-2017-17476 | High | 8.8 | 2017-12-20 | Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attacke… |
CVE-2017-17789 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. |
CVE-2017-17788 | Medium | 5.5 | 2017-12-20 | In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string. |
CVE-2017-17787 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c. |
CVE-2017-17786 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel… |
CVE-2017-17785 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c. |
CVE-2017-17784 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 da… |
CVE-2017-17783 | High | 7.5 | 2017-12-20 | In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8. |
CVE-2017-17782 | High | 8.8 | 2017-12-20 | In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation. |
CVE-2017-17741 | Medium | 6.5 | 2017-12-18 | The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio sta… |
CVE-2017-17670 | High | 8.8 | 2017-12-15 | In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid… |
CVE-2017-17405 | High | 8.8 | 2017-12-15 | Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a lo… |
CVE-2017-16355 | Medium | 4.7 | 2017-12-14 | In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is runnin… |
CVE-2017-17527 | High | 8.8 | 2017-12-14 | delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which mi… |
CVE-2017-17520 | High | 8.8 | 2017-12-14 | tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remot… |
CVE-2017-17515 | High | 8.8 | 2017-12-14 | etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote… |
CVE-2017-17514 | High | 8.8 | 2017-12-14 | boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers… |