Opensuse
Page 7 of 18 — Opensuse CVEs from a corpus of 1778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2757 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8… |
CVE-2020-2756 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8… |
CVE-2020-2755 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0… |
CVE-2020-2754 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0… |
CVE-2020-2752 | Medium | 5.3 | 2020-04-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8… |
CVE-2020-2748 | Low | 3.2 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-2743 | Medium | 6.0 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior t… |
CVE-2020-2742 | High | 8.2 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior t… |
CVE-2020-2741 | Medium | 6.0 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-5260 | Critical | 9.3 | 2020-04-14 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses externa… |
CVE-2020-11765 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, le… |
CVE-2020-11764 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. |
CVE-2020-11763 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. |
CVE-2020-11762 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling th… |
CVE-2020-11760 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp. |
CVE-2020-11758 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h. |
CVE-2020-11741 | High | 8.8 | 2020-04-14 | An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests… |
CVE-2020-11740 | Medium | 5.5 | 2020-04-14 | An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guest… |
CVE-2020-11739 | High | 7.8 | 2020-04-14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barri… |
CVE-2020-6456 | Medium | 6.5 | 2020-04-13 | Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted cl… |
CVE-2020-6455 | High | 8.8 | 2020-04-13 | Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6454 | High | 8.8 | 2020-04-13 | Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2020-6452 | High | 8.8 | 2020-04-13 | Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6451 | High | 8.8 | 2020-04-13 | Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6450 | High | 8.8 | 2020-04-13 | Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6448 | High | 8.8 | 2020-04-13 | Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6447 | High | 8.8 | 2020-04-13 | Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to… |
CVE-2020-6446 | Medium | 6.5 | 2020-04-13 | Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a craft… |
CVE-2020-6445 | Medium | 6.5 | 2020-04-13 | Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a craft… |
CVE-2020-6444 | Medium | 6.3 | 2020-04-13 | Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6443 | High | 8.8 | 2020-04-13 | Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to… |
CVE-2020-6442 | Medium | 4.3 | 2020-04-13 | Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6441 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page. |
CVE-2020-6440 | Medium | 4.3 | 2020-04-13 | Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2020-6439 | High | 8.8 | 2020-04-13 | Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page. |
CVE-2020-6438 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6437 | Medium | 4.3 | 2020-04-13 | Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted application. |
CVE-2020-6436 | High | 8.8 | 2020-04-13 | Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6435 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2020-6434 | High | 8.8 | 2020-04-13 | Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6433 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2020-6432 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2020-6431 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6430 | High | 8.8 | 2020-04-13 | Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6423 | High | 8.8 | 2020-04-13 | Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-11647 | High | 7.5 | 2020-04-10 | In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by li… |
CVE-2020-11669 | Medium | 5.5 | 2020-04-10 | An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for… |
CVE-2020-8834 | Medium | 6.5 | 2020-04-09 | KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, lea… |
CVE-2020-11653 | High | 7.5 | 2020-04-08 | An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termin… |
CVE-2019-20637 | High | 7.5 | 2020-04-08 | An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handli… |
CVE-2020-11501 | High | 7.4 | 2020-04-03 | GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit… |
CVE-2019-18905 | Medium | 4.8 | 2020-04-03 | A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote a… |
CVE-2019-18904 | Medium | 6.5 | 2020-04-03 | A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance C… |
CVE-2020-11494 | Medium | 4.4 | 2020-04-02 | An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data… |
CVE-2020-11100 | High | 8.8 | 2020-04-02 | In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain l… |
CVE-2020-8017 | Medium | 6.2 | 2020-04-02 | A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications… |
CVE-2020-8016 | Medium | 4.9 | 2020-04-02 | A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1… |
CVE-2020-8015 | High | 8.4 | 2020-04-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root… |
CVE-2020-1927 | Medium | 6.1 | 2020-04-02 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and… |
CVE-2020-1934 | Medium | 5.3 | 2020-04-01 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. |
CVE-2020-7066 | Medium | 5.3 | 2020-04-01 | In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) c… |
CVE-2020-7064 | Medium | 6.5 | 2020-04-01 | In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicio… |
CVE-2019-14905 | Medium | 5.6 | 2020-03-31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy… |
CVE-2020-6095 | High | 7.5 | 2020-03-27 | An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup requ… |
CVE-2020-1772 | Medium | 6.5 | 2020-03-27 | It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which alr… |
CVE-2020-1770 | Low | 2.4 | 2020-03-27 | Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0… |
CVE-2020-1769 | Low | 3.5 | 2020-03-27 | In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue… |
CVE-2020-10942 | Medium | 5.3 | 2020-03-24 | In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel s… |
CVE-2020-10938 | Critical | 9.8 | 2020-03-24 | GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c. |
CVE-2020-1747 | Critical | 9.8 | 2020-03-24 | A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted… |
CVE-2020-6449 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6429 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6428 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6427 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6426 | Medium | 6.5 | 2020-03-23 | Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6425 | Medium | 5.4 | 2020-03-23 | Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6424 | High | 8.8 | 2020-03-23 | Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6422 | High | 8.8 | 2020-03-23 | Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-10593 | High | 7.5 | 2020-03-23 | Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. T… |
CVE-2020-10592 | High | 7.5 | 2020-03-23 | Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-00… |
CVE-2020-10803 | Medium | 5.4 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack t… |
CVE-2020-10802 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when g… |
CVE-2020-10804 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/… |
CVE-2019-17185 | High | 7.5 | 2020-03-21 | In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same B… |
CVE-2019-18860 | Medium | 6.1 | 2020-03-20 | Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. |
CVE-2020-5267 | Medium | 4.0 | 2020-03-19 | In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the… |
CVE-2020-10648 | High | 7.8 | 2020-03-19 | Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a s… |
CVE-2019-12921 | Medium | 6.5 | 2020-03-18 | In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for… |
CVE-2020-0556 | High | 7.1 | 2020-03-12 | Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial o… |
CVE-2020-10531 | High | 8.8 | 2020-03-12 | An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exi… |
CVE-2020-7598 | Medium | 5.6 | 2020-03-11 | minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload. |
CVE-2019-20382 | Low | 3.5 | 2020-03-05 | QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation whe… |
CVE-2020-10029 | Medium | 5.5 | 2020-03-04 | The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function conta… |
CVE-2019-3696 | High | 8.4 | 2020-03-03 | A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPO… |
CVE-2019-3695 | High | 8.4 | 2020-03-03 | A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterpr… |
CVE-2020-10018 | Critical | 9.8 | 2020-03-02 | WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that ma… |
CVE-2020-8013 | Low | 2.2 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Se… |
CVE-2019-18903 | High | 7.5 | 2020-03-02 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attacke… |
CVE-2019-18902 | High | 7.5 | 2020-03-02 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attacke… |
CVE-2019-18901 | Medium | 5.1 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Ente… |