Debian
Page 82 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-2347 | High | 7.8 | 2017-04-21 | Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a c… |
CVE-2017-7718 | Medium | 5.5 | 2017-04-20 | hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU proce… |
CVE-2017-7943 | Medium | 6.5 | 2017-04-18 | The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file. |
CVE-2017-7941 | Medium | 6.5 | 2017-04-18 | The ReadSGIImage function in sgi.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file. |
CVE-2017-7645 | High | 7.5 | 2017-04-18 | The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long… |
CVE-2016-7551 | High | 7.5 | 2017-04-17 | chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote… |
CVE-2017-7889 | High | 7.8 | 2017-04-17 | The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or w… |
CVE-2017-7868 | High | 7.5 | 2017-04-14 | International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8Tex… |
CVE-2017-7867 | High | 7.5 | 2017-04-14 | International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8Tex… |
CVE-2017-7865 | Critical | 9.8 | 2017-04-14 | FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcode… |
CVE-2017-7863 | Critical | 9.8 | 2017-04-14 | FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c. |
CVE-2015-8619 | High | 7.5 | 2017-04-13 | The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash). |
CVE-2015-8567 | High | 7.7 | 2017-04-13 | Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption). |
CVE-2015-8345 | Medium | 6.5 | 2017-04-13 | The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving… |
CVE-2015-6674 | Critical | 9.8 | 2017-04-13 | Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE: This issue exists… |
CVE-2012-6697 | High | 7.5 | 2017-04-13 | InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop). |
CVE-2017-7747 | High | 7.5 | 2017-04-12 | In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash, triggered by packet injection or a malformed capture file. This was addres… |
CVE-2017-7746 | High | 7.5 | 2017-04-12 | In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file… |
CVE-2017-7703 | High | 7.5 | 2017-04-12 | In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed… |
CVE-2017-7700 | Medium | 6.5 | 2017-04-12 | In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addr… |
CVE-2017-7697 | Medium | 5.5 | 2017-04-11 | In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file. |
CVE-2015-8666 | High | 7.9 | 2017-04-11 | Heap-based buffer overflow in QEMU, when built with the Q35-chipset-based PC system emulator. |
CVE-2015-8613 | Medium | 6.5 | 2017-04-11 | Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to… |
CVE-2015-8568 | Medium | 6.5 | 2017-04-11 | Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory cons… |
CVE-2015-8504 | Medium | 6.5 | 2017-04-11 | Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted… |
CVE-2016-5322 | Medium | 5.5 | 2017-04-11 | The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif… |
CVE-2016-1908 | Critical | 9.8 | 2017-04-11 | The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisio… |
CVE-2016-4483 | High | 7.5 | 2017-04-11 | The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and appl… |
CVE-2017-7377 | Medium | 6.0 | 2017-04-10 | The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of serv… |
CVE-2016-1516 | High | 8.8 | 2017-04-10 | OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. |
CVE-2017-7613 | Medium | 5.5 | 2017-04-09 | elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (me… |
CVE-2017-7612 | Medium | 5.5 | 2017-04-09 | The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application c… |
CVE-2017-7611 | Medium | 5.5 | 2017-04-09 | The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and applicatio… |
CVE-2017-7610 | Medium | 5.5 | 2017-04-09 | The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash… |
CVE-2017-7608 | Medium | 5.5 | 2017-04-09 | The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-r… |
CVE-2016-8735 | Critical | 9.8 | 2017-04-06 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRe… |
CVE-2014-5008 | Critical | 9.8 | 2017-03-31 | Snoopy allows remote attackers to execute arbitrary commands. |
CVE-2017-6964 | High | 7.8 | 2017-03-28 | dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might… |
CVE-2017-5973 | Medium | 5.5 | 2017-03-27 | The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite lo… |
CVE-2017-5511 | Critical | 9.8 | 2017-03-24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow. |
CVE-2017-5510 | High | 7.8 | 2017-03-24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write. |
CVE-2017-5507 | High | 7.5 | 2017-03-24 | Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2017-5506 | High | 7.8 | 2017-03-24 | Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file. |
CVE-2016-10149 | High | 7.5 | 2017-03-24 | XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response. |
CVE-2016-9556 | Medium | 5.5 | 2017-03-23 | The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) v… |
CVE-2017-5897 | Critical | 9.8 | 2017-03-23 | The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6… |
CVE-2016-9775 | High | 7.8 | 2017-03-23 | The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 o… |
CVE-2016-9774 | High | 7.8 | 2017-03-23 | The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS… |
CVE-2017-6836 | Medium | 5.5 | 2017-03-20 | Heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3… |
CVE-2017-6834 | Medium | 5.5 | 2017-03-20 | Heap-based buffer overflow in the ulaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0… |
CVE-2017-6832 | Medium | 5.5 | 2017-03-20 | Heap-based buffer overflow in the decodeBlock in MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.2.7 allow… |
CVE-2017-6831 | Medium | 5.5 | 2017-03-20 | Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and… |
CVE-2017-5987 | Medium | 5.5 | 2017-03-20 | The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service… |
CVE-2017-7178 | High | 8.8 | 2017-03-18 | CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary progra… |
CVE-2017-6960 | High | 7.5 | 2017-03-17 | An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer over-read, related to the load_apng function and the ima… |
CVE-2017-5856 | Medium | 6.5 | 2017-03-16 | Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of s… |
CVE-2017-5667 | Medium | 6.5 | 2017-03-16 | The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service… |
CVE-2017-5617 | High | 7.4 | 2017-03-16 | The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks v… |
CVE-2016-10247 | Medium | 5.5 | 2017-03-16 | Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial o… |
CVE-2016-10246 | Medium | 5.5 | 2017-03-16 | Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of serv… |
CVE-2017-5522 | Critical | 9.8 | 2017-03-15 | Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial… |
CVE-2016-7103 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText param… |
CVE-2017-5579 | Medium | 6.5 | 2017-03-15 | Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of servi… |
CVE-2017-5526 | Medium | 6.5 | 2017-03-15 | Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and… |
CVE-2017-5525 | Medium | 6.5 | 2017-03-15 | Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QE… |
CVE-2016-10197 | High | 7.5 | 2017-03-15 | The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname. |
CVE-2016-10196 | High | 7.5 | 2017-03-15 | Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service… |
CVE-2016-10195 | Critical | 9.8 | 2017-03-15 | The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variabl… |
CVE-2016-10155 | Medium | 6.0 | 2017-03-15 | Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consump… |
CVE-2017-6060 | High | 7.8 | 2017-03-15 | Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted… |
CVE-2017-5938 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to i… |
CVE-2017-6817 | Medium | 5.4 | 2017-03-12 | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. |
CVE-2017-6816 | Medium | 4.9 | 2017-03-12 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. |
CVE-2017-6815 | Medium | 6.1 | 2017-03-12 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. |
CVE-2017-6814 | Medium | 5.4 | 2017-03-12 | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playl… |
CVE-2017-6802 | High | 7.5 | 2017-03-10 | An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF()… |
CVE-2017-6801 | High | 7.5 | 2017-03-10 | An issue was discovered in ytnef before 1.9.2. There is a potential out-of-bounds access with fields of Size 0 in TNEFParse() in libytnef. |
CVE-2017-6800 | High | 7.5 | 2017-03-10 | An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to… |
CVE-2016-8714 | High | 8.8 | 2017-03-10 | An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script… |
CVE-2017-6314 | Medium | 5.5 | 2017-03-10 | The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIF… |
CVE-2017-6313 | High | 7.1 | 2017-03-10 | Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read… |
CVE-2017-6312 | Medium | 5.5 | 2017-03-10 | Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a cra… |
CVE-2017-2636 | High | 7.0 | 2017-03-07 | Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by s… |
CVE-2016-8863 | Critical | 9.8 | 2017-03-07 | Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to ca… |
CVE-2016-6255 | High | 7.5 | 2017-03-07 | Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handle… |
CVE-2016-5315 | Medium | 5.5 | 2017-03-07 | The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif… |
CVE-2013-5653 | Medium | 5.5 | 2017-03-07 | The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript… |
CVE-2016-10244 | High | 7.8 | 2017-03-06 | The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to c… |
CVE-2017-6500 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read. |
CVE-2017-6499 | Medium | 5.5 | 2017-03-06 | An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS). |
CVE-2017-6498 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS. |
CVE-2017-6474 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in w… |
CVE-2017-6473 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c b… |
CVE-2017-6472 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. This was… |
CVE-2017-6471 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in… |
CVE-2017-6470 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed… |
CVE-2017-6469 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addresse… |
CVE-2017-6468 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/n… |
CVE-2017-6467 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This was addressed in w… |
CVE-2017-5356 | High | 7.5 | 2017-03-03 | Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) with… |