Opensuse
Page 2 of 18 — Opensuse CVEs from a corpus of 1778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15976 | High | 8.8 | 2020-11-03 | Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-15975 | High | 8.8 | 2020-11-03 | Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15974 | High | 8.8 | 2020-11-03 | Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2020-15973 | Medium | 6.5 | 2020-11-03 | Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15972 | High | 8.8 | 2020-11-03 | Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15971 | High | 8.8 | 2020-11-03 | Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-15970 | High | 8.8 | 2020-11-03 | Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbo… |
CVE-2020-15969 | High | 8.8 | 2020-11-03 | Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15968 | High | 8.8 | 2020-11-03 | Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15967 | High | 8.8 | 2020-11-03 | Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2020-14323 | Medium | 5.5 | 2020-10-29 | A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this f… |
CVE-2020-27673 | Medium | 5.5 | 2020-10-22 | An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a h… |
CVE-2020-27672 | High | 7.0 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privi… |
CVE-2020-27671 | High | 7.8 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or pos… |
CVE-2020-27670 | High | 7.8 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain p… |
CVE-2020-15683 | Critical | 9.8 | 2020-10-22 | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory c… |
CVE-2020-27560 | Low | 3.3 | 2020-10-22 | ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service. |
CVE-2020-14803 | Medium | 5.3 | 2020-10-21 | Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploita… |
CVE-2020-14798 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14797 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14796 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14792 | Medium | 4.2 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14782 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14781 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11… |
CVE-2020-14779 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8… |
CVE-2020-25829 | High | 7.5 | 2020-10-16 | An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a gi… |
CVE-2020-27153 | High | 8.6 | 2020-10-15 | In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of… |
CVE-2020-15229 | High | 8.2 | 2020-10-14 | Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack o… |
CVE-2020-25645 | High | 7.5 | 2020-10-13 | A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt tr… |
CVE-2020-26935 | Critical | 9.8 | 2020-10-10 | An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin pro… |
CVE-2020-26934 | Medium | 6.1 | 2020-10-10 | phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. |
CVE-2020-26164 | Medium | 5.5 | 2020-10-07 | In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memor… |
CVE-2020-11800 | Critical | 9.8 | 2020-10-07 | Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. |
CVE-2020-14355 | Medium | 6.6 | 2020-10-07 | Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPIC… |
CVE-2020-25866 | High | 7.5 | 2020-10-06 | In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not unco… |
CVE-2020-25863 | High | 7.5 | 2020-10-06 | In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multi… |
CVE-2020-25862 | High | 7.5 | 2020-10-06 | In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changin… |
CVE-2020-25643 | High | 7.2 | 2020-10-06 | A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input valid… |
CVE-2020-25641 | Medium | 5.5 | 2020-10-06 | A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could c… |
CVE-2020-25637 | Medium | 6.7 | 2020-10-06 | A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of… |
CVE-2020-8228 | Medium | 5.3 | 2020-10-05 | A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. |
CVE-2020-7070 | Medium | 4.3 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-dec… |
CVE-2020-7069 | Medium | 5.4 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only… |
CVE-2020-15678 | High | 8.8 | 2020-10-01 | When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the… |
CVE-2020-15677 | Medium | 6.1 | 2020-10-01 | By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original s… |
CVE-2020-15676 | Medium | 6.1 | 2020-10-01 | Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attack… |
CVE-2020-15673 | High | 8.8 | 2020-10-01 | Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2020-14374 | High | 8.8 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing… |
CVE-2020-14378 | Low | 3.3 | 2020-09-30 | An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in… |
CVE-2020-14377 | High | 7.1 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer o… |
CVE-2020-14376 | High | 7.8 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest memory into host memo… |
CVE-2020-14375 | High | 7.8 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessib… |
CVE-2020-26154 | Critical | 9.8 | 2020-09-30 | url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-l… |
CVE-2020-26117 | High | 8.1 | 2020-09-27 | In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as autho… |
CVE-2020-26116 | High | 7.2 | 2020-09-27 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTT… |
CVE-2020-15211 | Medium | 4.8 | 2020-09-25 | In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set… |
CVE-2020-15210 | Medium | 6.5 | 2020-09-25 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator… |
CVE-2020-15209 | Medium | 5.9 | 2020-09-25 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullpt… |
CVE-2020-15208 | High | 7.4 | 2020-09-25 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` whi… |
CVE-2020-15207 | High | 8.7 | 2020-09-25 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, to mimic Python's indexing with negative values, TFLite uses `ResolveAxis` to convert… |
CVE-2020-15206 | Critical | 9.0 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's `SavedModel` protocol buffer and altering the name of required k… |
CVE-2020-15205 | Critical | 9.0 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a us… |
CVE-2020-15204 | Medium | 5.3 | 2020-09-25 | In eager mode, TensorFlow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or… |
CVE-2020-15203 | High | 7.5 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able t… |
CVE-2020-15202 | Critical | 9.0 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64… |
CVE-2020-15195 | High | 8.5 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern. It is poss… |
CVE-2020-15194 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of it… |
CVE-2020-15193 | High | 7.1 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory cor… |
CVE-2020-15192 | Medium | 4.3 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation… |
CVE-2020-15191 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind… |
CVE-2020-15190 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two te… |
CVE-2019-11556 | Medium | 6.1 | 2020-09-25 | Pagure before 5.6 allows XSS via the templates/blame.html blame view. |
CVE-2020-26088 | Medium | 5.5 | 2020-09-24 | A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets… |
CVE-2020-25604 | Medium | 4.7 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests b… |
CVE-2020-25603 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures… |
CVE-2020-25602 | Medium | 6.0 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses… |
CVE-2020-25601 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model… |
CVE-2020-25600 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model impo… |
CVE-2020-25599 | High | 7.0 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCT… |
CVE-2020-25598 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchro… |
CVE-2020-25596 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various stat… |
CVE-2020-25595 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified th… |
CVE-2020-6576 | High | 8.8 | 2020-09-21 | Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6575 | High | 8.3 | 2020-09-21 | Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape… |
CVE-2020-6574 | High | 7.8 | 2020-09-21 | Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalati… |
CVE-2020-6573 | Critical | 9.6 | 2020-09-21 | Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2020-6571 | Medium | 4.3 | 2020-09-21 | Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a cr… |
CVE-2020-6570 | Medium | 4.3 | 2020-09-21 | Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC… |
CVE-2020-6569 | Medium | 6.3 | 2020-09-21 | Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit hea… |
CVE-2020-6568 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restriction… |
CVE-2020-6567 | Medium | 6.5 | 2020-09-21 | Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navig… |
CVE-2020-6566 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6565 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2020-6564 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a… |
CVE-2020-6563 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive… |
CVE-2020-6562 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6561 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafte… |
CVE-2020-6560 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6559 | High | 8.8 | 2020-09-21 | Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-6558 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a craft… |