Opensuse
Page 5 of 18 — Opensuse CVEs from a corpus of 1778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11099 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of… |
CVE-2020-11098 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is… |
CVE-2020-11097 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-11096 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-ca… |
CVE-2020-11095 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-14983 | Critical | 9.8 | 2020-06-22 | The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user… |
CVE-2020-8933 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-8907 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-8903 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-14954 | Medium | 5.9 | 2020-06-21 | Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response… |
CVE-2020-8165 | Critical | 9.8 | 2020-06-19 | A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects i… |
CVE-2020-8164 | High | 7.5 | 2020-06-19 | A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadverte… |
CVE-2017-9104 | Critical | 9.8 | 2020-06-18 | An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. |
CVE-2017-9103 | Critical | 9.8 | 2020-06-18 | An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value c… |
CVE-2020-14422 | Medium | 5.9 | 2020-06-18 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to… |
CVE-2017-9109 | Critical | 9.8 | 2020-06-18 | An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the se… |
CVE-2017-9108 | High | 7.5 | 2020-06-18 | An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r… |
CVE-2020-14416 | Medium | 4.2 | 2020-06-18 | In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0a… |
CVE-2020-8619 | Medium | 4.9 | 2020-06-17 | In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a… |
CVE-2020-8618 | Medium | 4.9 | 2020-06-17 | An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially c… |
CVE-2020-14401 | Medium | 6.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow. |
CVE-2020-14400 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties… |
CVE-2020-14399 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is repor… |
CVE-2020-14398 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c. |
CVE-2020-14397 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference. |
CVE-2019-20840 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode. |
CVE-2019-20839 | High | 7.5 | 2020-06-17 | libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename. |
CVE-2018-21247 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectTo… |
CVE-2020-0543 | Medium | 5.5 | 2020-06-15 | Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2020-14093 | Medium | 5.9 | 2020-06-15 | Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. |
CVE-2020-14004 | High | 7.8 | 2020-06-12 | An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cm… |
CVE-2020-10732 | Low | 3.3 | 2020-06-12 | A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and… |
CVE-2020-1269 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-10761 | Medium | 5.0 | 2020-06-09 | An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends… |
CVE-2020-10757 | High | 7.8 | 2020-06-09 | A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX… |
CVE-2020-13962 | High | 7.5 | 2020-06-09 | Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of servic… |
CVE-2020-13844 | Medium | 5.5 | 2020-06-08 | Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to… |
CVE-2020-13696 | Medium | 4.4 | 2020-06-08 | An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged call… |
CVE-2020-12803 | Medium | 6.5 | 2020-06-08 | ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an exte… |
CVE-2020-12802 | Medium | 5.3 | 2020-06-08 | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default… |
CVE-2020-12723 | High | 7.5 | 2020-06-05 | regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. |
CVE-2020-10878 | High | 8.6 | 2020-06-05 | Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to mal… |
CVE-2020-10543 | High | 8.2 | 2020-06-05 | Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. |
CVE-2020-13800 | Medium | 6.0 | 2020-06-04 | ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_writ… |
CVE-2020-13817 | High | 7.4 | 2020-06-04 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting tra… |
CVE-2020-6496 | High | 8.8 | 2020-06-03 | Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2020-6495 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6494 | Medium | 6.5 | 2020-06-03 | Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2020-6493 | Critical | 9.6 | 2020-06-03 | Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2020-11080 | Low | 3.7 | 2020-06-03 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious cli… |
CVE-2020-13379 | High | 8.2 | 2020-06-03 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make… |
CVE-2019-20810 | Medium | 5.5 | 2020-06-03 | go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory l… |
CVE-2020-13659 | Low | 2.5 | 2020-06-02 | address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. |
CVE-2020-12867 | Medium | 5.5 | 2020-06-01 | A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim t… |
CVE-2020-11089 | Low | 3.7 | 2020-05-29 | In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, print… |
CVE-2020-11088 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. |
CVE-2020-11087 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0. |
CVE-2020-11086 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an intern… |
CVE-2020-11085 | Low | 2.6 | 2020-05-29 | In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bo… |
CVE-2020-11043 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on sc… |
CVE-2020-11040 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This ha… |
CVE-2020-11041 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse… |
CVE-2020-11039 | High | 8.0 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to i… |
CVE-2020-11038 | Medium | 6.9 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the cli… |
CVE-2020-11019 | Medium | 4.3 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid a… |
CVE-2020-11018 | Medium | 6.5 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causi… |
CVE-2020-11017 | Medium | 6.5 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixe… |
CVE-2020-13362 | Low | 3.2 | 2020-05-28 | In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. |
CVE-2020-13361 | Low | 3.9 | 2020-05-28 | In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out… |
CVE-2019-20807 | Medium | 5.3 | 2020-05-28 | In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua). |
CVE-2020-13614 | Medium | 5.9 | 2020-05-26 | An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification. |
CVE-2020-6831 | Critical | 9.8 | 2020-05-26 | A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash… |
CVE-2020-13398 | High | 8.3 | 2020-05-22 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto… |
CVE-2020-13397 | Medium | 5.5 | 2020-05-22 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/securi… |
CVE-2020-13396 | High | 7.1 | 2020-05-22 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/ss… |
CVE-2020-11077 | Medium | 6.8 | 2020-05-22 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown clien… |
CVE-2020-10711 | Medium | 5.9 | 2020-05-22 | A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Se… |
CVE-2020-12693 | High | 8.1 | 2020-05-21 | Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate P… |
CVE-2020-13113 | High | 8.2 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free con… |
CVE-2020-13114 | High | 7.5 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of comp… |
CVE-2020-13112 | Critical | 9.1 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This i… |
CVE-2020-6491 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain nam… |
CVE-2020-6490 | Medium | 4.3 | 2020-05-21 | Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin… |
CVE-2020-6489 | Medium | 4.3 | 2020-05-21 | Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain act… |
CVE-2020-6488 | Medium | 4.3 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6487 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6486 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2020-6485 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2020-6484 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted r… |
CVE-2020-6483 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2020-6482 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6481 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to perform domain spoofing via a crafted dom… |
CVE-2020-6480 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass navigation restrictions via UI actions. |
CVE-2020-6479 | Medium | 6.5 | 2020-05-21 | Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6478 | Medium | 6.5 | 2020-05-21 | Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6477 | High | 7.8 | 2020-05-21 | Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted… |
CVE-2020-6476 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2020-6475 | Medium | 6.5 | 2020-05-21 | Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6474 | High | 8.8 | 2020-05-21 | Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6473 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from proc… |