Debian
Page 81 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-5211 | Critical | 9.6 | 2017-05-25 | Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Do… |
CVE-2017-9216 | Medium | 6.5 | 2017-05-24 | libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c… |
CVE-2017-8314 | Medium | 5.5 | 2017-05-23 | Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles. |
CVE-2017-8312 | Medium | 5.5 | 2017-05-23 | Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitl… |
CVE-2017-9214 | Critical | 9.8 | 2017-05-23 | In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integ… |
CVE-2017-8379 | Medium | 6.5 | 2017-05-23 | Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host… |
CVE-2017-8309 | High | 7.5 | 2017-05-23 | Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting… |
CVE-2016-9843 | Critical | 9.8 | 2017-05-23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calcula… |
CVE-2016-9842 | High | 8.8 | 2017-05-23 | The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of neg… |
CVE-2016-9841 | Critical | 9.8 | 2017-05-23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. |
CVE-2016-9840 | High | 8.8 | 2017-05-23 | inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. |
CVE-2016-5178 | Critical | 9.8 | 2017-05-23 | Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact vi… |
CVE-2016-5177 | High | 8.8 | 2017-05-23 | Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecif… |
CVE-2017-6891 | High | 8.8 | 2017-05-22 | Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow… |
CVE-2017-9144 | Medium | 6.5 | 2017-05-22 | In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. |
CVE-2017-9143 | Medium | 6.5 | 2017-05-22 | In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file. |
CVE-2017-9142 | Medium | 6.5 | 2017-05-22 | In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the R… |
CVE-2017-9141 | Medium | 6.5 | 2017-05-22 | In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of miss… |
CVE-2017-2520 | Critical | 9.8 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS bef… |
CVE-2017-2519 | Critical | 9.8 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS bef… |
CVE-2017-2518 | Critical | 9.8 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS bef… |
CVE-2017-9098 | High | 7.5 | 2017-05-19 | ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information fro… |
CVE-2017-9079 | Medium | 4.7 | 2017-05-19 | Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occ… |
CVE-2017-9078 | High | 8.8 | 2017-05-19 | The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the… |
CVE-2017-9076 | High | 7.8 | 2017-05-19 | The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial… |
CVE-2017-9075 | High | 7.8 | 2017-05-19 | The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial… |
CVE-2017-9066 | High | 8.6 | 2017-05-18 | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. |
CVE-2017-9065 | High | 7.5 | 2017-05-18 | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. |
CVE-2017-9064 | High | 8.8 | 2017-05-18 | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for up… |
CVE-2017-9063 | Medium | 6.1 | 2017-05-18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. |
CVE-2017-9062 | High | 8.6 | 2017-05-18 | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. |
CVE-2017-9061 | Medium | 6.1 | 2017-05-18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not pro… |
CVE-2017-7493 | High | 7.8 | 2017-05-17 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It… |
CVE-2017-8849 | High | 7.8 | 2017-05-17 | smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service. |
CVE-2017-7487 | High | 7.8 | 2017-05-14 | The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of ser… |
CVE-2017-8925 | Medium | 5.5 | 2017-05-12 | The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by… |
CVE-2017-8924 | Medium | 4.6 | 2017-05-12 | The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the d… |
CVE-2017-8890 | High | 7.8 | 2017-05-10 | The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double f… |
CVE-2017-8846 | Medium | 5.5 | 2017-05-08 | The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash)… |
CVE-2017-8844 | High | 7.8 | 2017-05-08 | The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application… |
CVE-2017-8831 | Medium | 6.4 | 2017-05-08 | The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out… |
CVE-2017-8829 | High | 7.8 | 2017-05-08 | Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted… |
CVE-2017-8112 | Medium | 6.5 | 2017-05-02 | hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via t… |
CVE-2017-8086 | Medium | 6.5 | 2017-05-02 | Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of serv… |
CVE-2017-7483 | High | 7.5 | 2017-05-02 | Rxvt 2.7.10 is vulnerable to a denial of service attack by passing the value -2^31 inside a terminal escape code, which results in a non-invertible integer tha… |
CVE-2016-10243 | Critical | 9.8 | 2017-05-02 | TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file. |
CVE-2017-8365 | Medium | 6.5 | 2017-04-30 | The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a craf… |
CVE-2017-8363 | Medium | 6.5 | 2017-04-30 | The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application… |
CVE-2017-8362 | Medium | 6.5 | 2017-04-30 | The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a cr… |
CVE-2017-8361 | High | 8.8 | 2017-04-30 | The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or po… |
CVE-2017-8357 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8356 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8355 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8354 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8353 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8352 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8351 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8350 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8349 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8348 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8347 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadEXRImage function in exr.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8346 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadDCMImage function in dcm.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8345 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8344 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8343 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-7957 | High | 7.5 | 2017-04-29 | XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshal… |
CVE-2017-7895 | Critical | 9.8 | 2017-04-28 | The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to tr… |
CVE-2017-8291 | High | 7.8 | 2017-04-27 | Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring… |
CVE-2017-8283 | Critical | 9.8 | 2017-04-26 | dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which… |
CVE-2017-5046 | Medium | 4.3 | 2017-04-24 | V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote… |
CVE-2017-5045 | Medium | 6.1 | 2017-04-24 | XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which… |
CVE-2017-5044 | Medium | 6.3 | 2017-04-24 | Heap buffer overflow in filter processing in Skia in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a re… |
CVE-2017-5043 | High | 8.8 | 2017-04-24 | Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perfor… |
CVE-2017-5042 | Medium | 5.7 | 2017-04-24 | Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed… |
CVE-2017-5040 | Medium | 4.3 | 2017-04-24 | V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attac… |
CVE-2017-5039 | High | 7.8 | 2017-04-24 | A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to potent… |
CVE-2017-5038 | Medium | 6.3 | 2017-04-24 | Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perfor… |
CVE-2017-5037 | High | 7.8 | 2017-04-24 | An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to per… |
CVE-2017-5036 | High | 7.8 | 2017-04-24 | A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have a… |
CVE-2017-5035 | High | 8.1 | 2017-04-24 | Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site. |
CVE-2017-5033 | Medium | 4.3 | 2017-04-24 | Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local… |
CVE-2017-5030 | High | 8.8 | 2017-04-24 | Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote a… |
CVE-2017-5029 | High | 8.8 | 2017-04-24 | The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2… |
CVE-2017-3600 | Medium | 6.6 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.54 and earlier, 5.6… |
CVE-2017-3544 | Low | 3.7 | 2017-04-24 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java S… |
CVE-2017-3539 | Low | 3.1 | 2017-04-24 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7… |
CVE-2017-3533 | Low | 3.7 | 2017-04-24 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java S… |
CVE-2017-3464 | Medium | 4.3 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 an… |
CVE-2017-3463 | Medium | 4.9 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.54 and e… |
CVE-2017-3462 | Medium | 4.9 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.54 and e… |
CVE-2017-3461 | Medium | 4.9 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.54 and e… |
CVE-2017-3456 | Medium | 4.9 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 an… |
CVE-2017-3453 | Medium | 6.5 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6… |
CVE-2017-3329 | High | 7.5 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Thread Pooling). Supported versions that are affected are 5.5.54 and earlier… |
CVE-2017-3309 | High | 7.7 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6… |
CVE-2017-3308 | High | 7.7 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 an… |
CVE-2017-3305 | Medium | 5.3 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6… |
CVE-2017-8105 | Critical | 9.8 | 2017-04-24 | FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1… |
CVE-2017-8073 | High | 7.5 | 2017-04-23 | WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function du… |
CVE-2017-8064 | High | 7.8 | 2017-04-23 | drivers/media/usb/dvb-usb-v2/dvb_usb_core.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which… |