Debian
Page 87 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-0650 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0649 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0648 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-0647 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-0646 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0644 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0643 | Low | 3.3 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-0642 | Medium | 4.7 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availabilit… |
CVE-2016-0641 | Medium | 5.1 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0640 | Medium | 6.1 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2015-8779 | Critical | 9.8 | 2016-04-19 | Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial… |
CVE-2015-8778 | Critical | 9.8 | 2016-04-19 | Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or p… |
CVE-2015-8776 | Critical | 9.1 | 2016-04-19 | The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash)… |
CVE-2015-7511 | Low | 2.0 | 2016-04-19 | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attacker… |
CVE-2014-9765 | High | 8.8 | 2016-04-19 | Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted in… |
CVE-2016-1659 | Critical | 9.8 | 2016-04-18 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknow… |
CVE-2016-1658 | Medium | 4.3 | 2016-04-18 | The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attacker… |
CVE-2016-1657 | Medium | 4.3 | 2016-04-18 | The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 50.0.2661.75 mishandles fo… |
CVE-2016-1655 | High | 8.8 | 2016-04-18 | Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a d… |
CVE-2016-1654 | Medium | 6.5 | 2016-04-18 | The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to cause a denial of… |
CVE-2016-1653 | High | 8.8 | 2016-04-18 | The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denia… |
CVE-2016-1652 | Medium | 6.1 | 2016-04-18 | Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in… |
CVE-2016-1651 | High | 8.1 | 2016-04-18 | fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb f… |
CVE-2015-8560 | High | 7.3 | 2016-04-14 | Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attack… |
CVE-2015-8540 | High | 8.8 | 2016-04-14 | Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1… |
CVE-2015-5343 | High | 7.6 | 2016-04-14 | Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a… |
CVE-2016-0787 | Medium | 5.9 | 2016-04-13 | The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middl… |
CVE-2016-0739 | Medium | 5.9 | 2016-04-13 | libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 1… |
CVE-2015-8806 | High | 7.5 | 2016-04-13 | dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediat… |
CVE-2015-8784 | Medium | 6.5 | 2016-04-13 | The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demons… |
CVE-2015-8683 | Medium | 5.5 | 2016-04-13 | The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF… |
CVE-2015-3146 | High | 7.5 | 2016-04-13 | The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote… |
CVE-2015-1547 | Medium | 6.5 | 2016-04-13 | The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, a… |
CVE-2014-9655 | Medium | 6.5 | 2016-04-13 | The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of se… |
CVE-2016-3982 | High | 8.8 | 2016-04-13 | Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read… |
CVE-2016-3981 | High | 7.8 | 2016-04-13 | Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bou… |
CVE-2016-3630 | High | 8.8 | 2016-04-13 | The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull command, related to… |
CVE-2016-3159 | Low | 3.8 | 2016-04-13 | The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allow… |
CVE-2016-3069 | High | 8.8 | 2016-04-13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. |
CVE-2016-3068 | High | 8.8 | 2016-04-13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository. |
CVE-2016-2533 | Medium | 6.5 | 2016-04-13 | Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attacke… |
CVE-2016-2228 | Medium | 6.1 | 2016-04-13 | Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition befor… |
CVE-2016-2191 | Medium | 6.5 | 2016-04-13 | The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash)… |
CVE-2016-2058 | Medium | 5.4 | 2016-04-13 | Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web scrip… |
CVE-2016-2057 | Low | 3.3 | 2016-04-13 | lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to in… |
CVE-2016-2056 | High | 8.8 | 2016-04-13 | xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_na… |
CVE-2016-2055 | High | 7.5 | 2016-04-13 | xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "c… |
CVE-2016-2054 | Critical | 9.8 | 2016-04-13 | Multiple buffer overflows in xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute arbitrary code or cause… |
CVE-2016-0775 | Medium | 6.5 | 2016-04-13 | Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash)… |
CVE-2016-0740 | Medium | 6.5 | 2016-04-13 | Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafte… |
CVE-2015-8807 | Medium | 6.1 | 2016-04-13 | Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupwa… |
CVE-2015-8552 | Medium | 4.4 | 2016-04-13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to gen… |
CVE-2015-8551 | Medium | 6.0 | 2016-04-13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit… |
CVE-2015-8080 | High | 7.5 | 2016-04-13 | Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission… |
CVE-2015-0861 | Medium | 4.3 | 2016-04-13 | model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypas… |
CVE-2014-6276 | Medium | 4.3 | 2016-04-13 | schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obta… |
CVE-2016-2118 | High | 7.5 | 2016-04-12 | The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, w… |
CVE-2016-3171 | High | 8.1 | 2016-04-12 | Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code v… |
CVE-2016-3170 | Medium | 5.3 | 2016-04-12 | The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive usern… |
CVE-2016-3169 | High | 8.1 | 2016-04-12 | The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls th… |
CVE-2016-3168 | Medium | 6.4 | 2016-04-12 | The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests t… |
CVE-2016-3167 | High | 7.4 | 2016-04-12 | Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users t… |
CVE-2016-3166 | Medium | 5.9 | 2016-04-12 | CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject ar… |
CVE-2016-3164 | High | 7.4 | 2016-04-12 | Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2… |
CVE-2016-3163 | High | 7.5 | 2016-04-12 | The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of… |
CVE-2016-3162 | High | 8.1 | 2016-04-12 | The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute… |
CVE-2015-8702 | High | 8.6 | 2016-04-12 | The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in… |
CVE-2015-8537 | Medium | 5.3 | 2016-04-12 | app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by… |
CVE-2015-8474 | High | 7.4 | 2016-04-12 | Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x… |
CVE-2015-8473 | Medium | 4.3 | 2016-04-12 | The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changes… |
CVE-2015-8346 | Medium | 5.3 | 2016-04-12 | app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information ab… |
CVE-2016-2857 | High | 8.4 | 2016-04-12 | The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via… |
CVE-2016-1568 | High | 8.8 | 2016-04-12 | Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance… |
CVE-2015-8710 | Critical | 9.8 | 2016-04-11 | The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory… |
CVE-2016-2385 | Critical | 9.8 | 2016-04-11 | Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote atta… |
CVE-2016-1235 | High | 8.8 | 2016-04-11 | The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors re… |
CVE-2012-6700 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a denial of service via a… |
CVE-2012-6699 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response. |
CVE-2012-6698 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response. |
CVE-2016-2381 | High | 7.5 | 2016-04-08 | Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. |
CVE-2016-3153 | Critical | 9.8 | 2016-04-08 | SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the fil… |
CVE-2016-2851 | Critical | 9.8 | 2016-04-07 | Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application… |
CVE-2016-2098 | High | 7.3 | 2016-04-07 | Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveragin… |
CVE-2016-2511 | Medium | 6.1 | 2016-04-07 | Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to l… |
CVE-2016-2510 | High | 8.1 | 2016-04-07 | BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbi… |
CVE-2016-2858 | Medium | 6.5 | 2016-04-07 | QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via… |
CVE-2015-8837 | High | 7.3 | 2016-03-30 | Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application… |
CVE-2016-1650 | High | 8.8 | 2016-03-29 | The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 all… |
CVE-2016-1649 | High | 8.8 | 2016-03-29 | The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-typ… |
CVE-2016-1648 | High | 8.8 | 2016-03-29 | Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before… |
CVE-2016-1647 | High | 8.8 | 2016-03-29 | Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implem… |
CVE-2016-1646 | High | 8.8 | 2016-03-29 | The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data t… |
CVE-2016-1762 | High | 8.1 | 2016-03-24 | The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. |
CVE-2016-2342 | High | 8.1 | 2016-03-17 | The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used… |
CVE-2016-2856 | High | 8.4 | 2016-03-14 | pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8… |
CVE-2016-1645 | High | 8.8 | 2016-03-13 | Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allo… |
CVE-2015-7560 | Medium | 6.5 | 2016-03-13 | The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticat… |
CVE-2016-1286 | High | 8.6 | 2016-03-09 | named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via… |
CVE-2016-1285 | Medium | 6.8 | 2016-03-09 | named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote… |
CVE-2016-2774 | Medium | 5.9 | 2016-03-09 | ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to ca… |