Fedoraproject
Page 37 of 55 — Fedoraproject CVEs from a corpus of 5439, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12137 | Medium | 6.1 | 2020-04-24 | GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against lis… |
CVE-2020-1760 | Medium | 5.8 | 2020-04-23 | A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks du… |
CVE-2020-11945 | Critical | 9.8 | 2020-04-23 | An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwis… |
CVE-2020-1983 | High | 7.5 | 2020-04-22 | A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. |
CVE-2020-12066 | High | 7.5 | 2020-04-22 | CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server. |
CVE-2020-11008 | Medium | 4.0 | 2020-04-21 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is simi… |
CVE-2020-1967 | High | 7.5 | 2020-04-21 | Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a res… |
CVE-2020-0081 | High | 7.8 | 2020-04-17 | In finalize of AssetManager.java, there is possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional… |
CVE-2020-11793 | High | 8.8 | 2020-04-17 | A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary… |
CVE-2020-2934 | Medium | 5.0 | 2020-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.19 and prior and 5.1.48 an… |
CVE-2020-2933 | Low | 2.2 | 2020-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 5.1.48 and prior. Difficult to… |
CVE-2020-2930 | Medium | 4.4 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.19 and prior. Difficult to… |
CVE-2020-2928 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exp… |
CVE-2020-2926 | Medium | 4.4 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.19 and prior… |
CVE-2020-2925 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.19 and prior. Easily exploitabl… |
CVE-2020-2924 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exp… |
CVE-2020-2923 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exp… |
CVE-2020-2921 | Medium | 4.4 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.19 and pr… |
CVE-2020-2904 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exp… |
CVE-2020-2903 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 8.0.19 and prior… |
CVE-2020-2901 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exp… |
CVE-2020-2898 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Charsets). The supported version that is affected is 8.0.19. Easily exploitable v… |
CVE-2020-2897 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exp… |
CVE-2020-2896 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.19 and prior. E… |
CVE-2020-2895 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vu… |
CVE-2020-2893 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vu… |
CVE-2020-2892 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exp… |
CVE-2020-2875 | Medium | 4.7 | 2020-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 an… |
CVE-2020-2853 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.18 and prior… |
CVE-2020-2830 | Medium | 5.3 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u2… |
CVE-2020-2814 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.47 and prior, 5.7.28 and prior and… |
CVE-2020-2812 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.47 and prior, 5.7… |
CVE-2020-2805 | High | 8.3 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241… |
CVE-2020-2804 | Medium | 5.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and… |
CVE-2020-2803 | High | 8.3 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241… |
CVE-2020-2800 | Medium | 4.8 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE… |
CVE-2020-2781 | Medium | 5.3 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11… |
CVE-2020-2780 | Medium | 6.5 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior… |
CVE-2020-2779 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.18 and prior… |
CVE-2020-2774 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.18 and prior… |
CVE-2020-2773 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241… |
CVE-2020-2770 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 8.0.18 and prior. Easily explo… |
CVE-2020-2765 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.29 and prior and 8.0.19… |
CVE-2020-2763 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.6.47 and prior, 5.7.29 a… |
CVE-2020-2762 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vu… |
CVE-2020-2761 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.18 and prior… |
CVE-2020-2760 | Medium | 5.5 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior… |
CVE-2020-2759 | Medium | 4.9 | 2020-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.19 and prior. Easily e… |
CVE-2020-2757 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8… |
CVE-2020-2756 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8… |
CVE-2020-2755 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0… |
CVE-2020-2754 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0… |
CVE-2020-2752 | Medium | 5.3 | 2020-04-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8… |
CVE-2020-10932 | Medium | 4.7 | 2020-04-15 | An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover th… |
CVE-2020-5260 | Critical | 9.3 | 2020-04-14 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses externa… |
CVE-2020-11765 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, le… |
CVE-2020-11764 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. |
CVE-2020-11763 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. |
CVE-2020-11762 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling th… |
CVE-2020-11761 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfF… |
CVE-2020-11760 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp. |
CVE-2020-11759 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineB… |
CVE-2020-11758 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h. |
CVE-2020-11743 | Medium | 5.5 | 2020-04-14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant ta… |
CVE-2020-11742 | Medium | 5.5 | 2020-04-14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Gran… |
CVE-2020-11741 | High | 8.8 | 2020-04-14 | An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests… |
CVE-2020-11740 | Medium | 5.5 | 2020-04-14 | An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guest… |
CVE-2020-11739 | High | 7.8 | 2020-04-14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barri… |
CVE-2020-1730 | Medium | 5.3 | 2020-04-13 | A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could… |
CVE-2020-6456 | Medium | 6.5 | 2020-04-13 | Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted cl… |
CVE-2020-6455 | High | 8.8 | 2020-04-13 | Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6454 | High | 8.8 | 2020-04-13 | Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2020-6452 | High | 8.8 | 2020-04-13 | Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6451 | High | 8.8 | 2020-04-13 | Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6450 | High | 8.8 | 2020-04-13 | Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6448 | High | 8.8 | 2020-04-13 | Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6447 | High | 8.8 | 2020-04-13 | Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to… |
CVE-2020-6446 | Medium | 6.5 | 2020-04-13 | Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a craft… |
CVE-2020-6445 | Medium | 6.5 | 2020-04-13 | Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a craft… |
CVE-2020-6444 | Medium | 6.3 | 2020-04-13 | Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6443 | High | 8.8 | 2020-04-13 | Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to… |
CVE-2020-6442 | Medium | 4.3 | 2020-04-13 | Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6441 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page. |
CVE-2020-6440 | Medium | 4.3 | 2020-04-13 | Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2020-6439 | High | 8.8 | 2020-04-13 | Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page. |
CVE-2020-6438 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6437 | Medium | 4.3 | 2020-04-13 | Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted application. |
CVE-2020-6436 | High | 8.8 | 2020-04-13 | Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6435 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2020-6434 | High | 8.8 | 2020-04-13 | Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6433 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2020-6432 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2020-6431 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6430 | High | 8.8 | 2020-04-13 | Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6423 | High | 8.8 | 2020-04-13 | Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-1759 | Medium | 6.4 | 2020-04-13 | A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure… |
CVE-2020-11612 | High | 7.5 | 2020-04-07 | The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large Zl… |
CVE-2013-7488 | High | 7.5 | 2020-04-07 | perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input. |
CVE-2020-11501 | High | 7.4 | 2020-04-03 | GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit… |
CVE-2020-8835 | High | 7.8 | 2020-04-02 | In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to o… |