Opensuse
Page 14 of 18 — Opensuse CVEs from a corpus of 1778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5820 | High | 8.8 | 2019-06-27 | Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5819 | High | 7.8 | 2019-06-27 | Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafte… |
CVE-2019-5818 | Medium | 6.5 | 2019-06-27 | Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-5817 | High | 8.8 | 2019-06-27 | Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2019-5816 | High | 8.8 | 2019-06-27 | Process lifetime issue in Chrome in Google Chrome on Android prior to 74.0.3729.108 allowed a remote attacker to potentially persist an exploited process via a… |
CVE-2019-5814 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5813 | High | 8.8 | 2019-06-27 | Use after free in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5811 | High | 8.8 | 2019-06-27 | Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML p… |
CVE-2019-5810 | Medium | 6.5 | 2019-06-27 | Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2019-5809 | High | 8.8 | 2019-06-27 | Use after free in file chooser in Google Chrome prior to 74.0.3729.108 allowed a remote attacker who had compromised the renderer process to perform privilege… |
CVE-2019-5808 | High | 8.8 | 2019-06-27 | Use after free in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5807 | High | 8.8 | 2019-06-27 | Object lifetime issue in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5806 | High | 8.8 | 2019-06-27 | Integer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2019-5805 | Medium | 6.5 | 2019-06-27 | Use-after-free in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-12979 | High | 7.8 | 2019-06-26 | ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage… |
CVE-2019-12976 | Medium | 5.5 | 2019-06-26 | ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. |
CVE-2019-12975 | Medium | 5.5 | 2019-06-26 | ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c. |
CVE-2019-12973 | Medium | 5.5 | 2019-06-26 | In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to caus… |
CVE-2019-10164 | High | 8.8 | 2019-06-26 | PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack… |
CVE-2019-12972 | Medium | 5.5 | 2019-06-26 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read i… |
CVE-2019-9836 | Medium | 5.3 | 2019-06-25 | Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and e… |
CVE-2019-12817 | High | 7.0 | 2019-06-25 | arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one anoth… |
CVE-2018-20843 | High | 7.5 | 2019-06-24 | In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM a… |
CVE-2019-12904 | Medium | 5.9 | 2019-06-20 | In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other proce… |
CVE-2019-12900 | Critical | 9.8 | 2019-06-19 | BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. |
CVE-2019-11040 | Critical | 9.1 | 2019-06-19 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 a… |
CVE-2019-11039 | Critical | 9.1 | 2019-06-19 | Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer… |
CVE-2019-11038 | Medium | 5.3 | 2019-06-19 | When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30… |
CVE-2019-8323 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefor… |
CVE-2019-8322 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore… |
CVE-2019-8321 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is po… |
CVE-2019-8325 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is… |
CVE-2019-8324 | High | 8.8 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could in… |
CVE-2019-10126 | Critical | 9.8 | 2019-06-14 | A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might le… |
CVE-2019-0197 | Medium | 4.2 | 2019-06-11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an… |
CVE-2019-0220 | Medium | 5.3 | 2019-06-11 | A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directiv… |
CVE-2019-10160 | Critical | 9.8 | 2019-06-07 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and… |
CVE-2019-12614 | Medium | 4.1 | 2019-06-03 | An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup o… |
CVE-2019-3846 | High | 8.8 | 2019-06-03 | A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wirel… |
CVE-2019-8457 | Critical | 9.8 | 2019-05-30 | SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. |
CVE-2019-12450 | Critical | 9.8 | 2019-05-29 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instea… |
CVE-2019-12449 | Medium | 5.7 | 2019-05-29 | An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with… |
CVE-2019-12447 | High | 7.3 | 2019-05-29 | An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used. |
CVE-2019-5436 | High | 7.8 | 2019-05-28 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. |
CVE-2019-5804 | Medium | 5.5 | 2019-05-23 | Incorrect command line processing in Chrome in Google Chrome prior to 73.0.3683.75 allowed a local attacker to perform domain spoofing via a crafted domain nam… |
CVE-2019-5803 | Medium | 6.5 | 2019-05-23 | Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy v… |
CVE-2019-5802 | Medium | 6.5 | 2019-05-23 | Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted… |
CVE-2019-5801 | Medium | 6.5 | 2019-05-23 | Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-5800 | Medium | 6.5 | 2019-05-23 | Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2019-5799 | Medium | 6.5 | 2019-05-23 | Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content… |
CVE-2019-5798 | Medium | 6.5 | 2019-05-23 | Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted… |
CVE-2019-5796 | High | 7.5 | 2019-05-23 | Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2019-5795 | High | 8.8 | 2019-05-23 | Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PD… |
CVE-2019-5794 | Medium | 6.5 | 2019-05-23 | Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafte… |
CVE-2019-5793 | Medium | 6.5 | 2019-05-23 | Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user int… |
CVE-2019-5792 | High | 8.8 | 2019-05-23 | Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PD… |
CVE-2019-5791 | High | 8.8 | 2019-05-23 | Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML pa… |
CVE-2019-5790 | High | 8.8 | 2019-05-23 | An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbi… |
CVE-2019-5789 | High | 8.8 | 2019-05-23 | An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised t… |
CVE-2019-5788 | High | 8.8 | 2019-05-23 | An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromis… |
CVE-2019-5787 | High | 8.8 | 2019-05-23 | Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2019-12221 | Medium | 6.5 | 2019-05-20 | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV… |
CVE-2019-3839 | High | 7.8 | 2019-05-16 | It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript… |
CVE-2019-12098 | High | 7.4 | 2019-05-15 | In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in k… |
CVE-2019-8936 | High | 7.5 | 2019-05-15 | NTP through 4.2.8p12 has a NULL Pointer Dereference. |
CVE-2019-11328 | High | 8.8 | 2019-05-14 | An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerab… |
CVE-2019-12083 | High | 8.1 | 2019-05-13 | The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and… |
CVE-2019-11884 | Low | 3.3 | 2019-05-10 | The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information… |
CVE-2019-11494 | High | 7.5 | 2019-05-08 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command. |
CVE-2019-5021 | Critical | 9.8 | 2019-05-08 | Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a… |
CVE-2019-11499 | High | 7.5 | 2019-05-08 | In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacc… |
CVE-2019-11815 | High | 8.1 | 2019-05-08 | An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related… |
CVE-2019-7443 | High | 8.1 | 2019-05-07 | KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cau… |
CVE-2018-19456 | High | 7.5 | 2019-05-07 | The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files… |
CVE-2019-11811 | High | 7.0 | 2019-05-07 | An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is rem… |
CVE-2018-20836 | High | 8.1 | 2019-05-07 | An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expand… |
CVE-2019-11036 | Critical | 9.1 | 2019-05-03 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated… |
CVE-2019-11627 | Critical | 9.8 | 2019-04-30 | gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID. |
CVE-2019-10131 | High | 7.1 | 2019-04-30 | An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker… |
CVE-2019-11506 | High | 8.8 | 2019-04-24 | In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, whic… |
CVE-2019-11505 | High | 8.8 | 2019-04-24 | In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which al… |
CVE-2019-10691 | High | 7.5 | 2019-04-24 | The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8… |
CVE-2019-3882 | Medium | 5.5 | 2019-04-24 | A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio d… |
CVE-2019-11486 | High | 7.0 | 2019-04-23 | The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions. |
CVE-2019-2698 | High | 8.1 | 2019-04-23 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to ex… |
CVE-2019-2684 | Medium | 5.9 | 2019-04-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202… |
CVE-2019-2628 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and pr… |
CVE-2019-2627 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and p… |
CVE-2019-2614 | Medium | 4.4 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7… |
CVE-2019-2602 | High | 7.5 | 2019-04-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211… |
CVE-2019-11474 | Medium | 6.5 | 2019-04-23 | coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (floating-point exception and application crash) by crafting an XWD image f… |
CVE-2019-11459 | Medium | 5.5 | 2019-04-22 | The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from T… |
CVE-2019-11235 | Critical | 9.8 | 2019-04-22 | FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid p… |
CVE-2019-11358 | Medium | 6.1 | 2019-04-20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an… |
CVE-2018-16878 | Medium | 5.5 | 2019-04-18 | A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS |
CVE-2018-16877 | High | 7.8 | 2019-04-18 | A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this fla… |
CVE-2019-11035 | Critical | 9.1 | 2019-04-18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated… |
CVE-2019-11034 | Critical | 9.1 | 2019-04-18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated… |
CVE-2019-9499 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validat… |
CVE-2019-9498 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the… |