Opensuse
Page 9 of 18 — Opensuse CVEs from a corpus of 1778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18899 | Medium | 6.2 | 2020-01-23 | The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers… |
CVE-2019-18898 | High | 7.7 | 2020-01-23 | UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers e… |
CVE-2019-20388 | High | 7.5 | 2020-01-21 | xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. |
CVE-2019-20387 | High | 7.5 | 2020-01-21 | repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input… |
CVE-2020-7040 | High | 8.1 | 2020-01-21 | storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation… |
CVE-2020-5202 | Medium | 5.5 | 2020-01-21 | apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program a… |
CVE-2019-19344 | Medium | 6.5 | 2020-01-21 | There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5… |
CVE-2019-18932 | High | 7.0 | 2020-01-21 | log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As… |
CVE-2019-14902 | Medium | 5.4 | 2020-01-21 | There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the re… |
CVE-2019-20386 | Low | 2.4 | 2020-01-21 | An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. |
CVE-2019-17361 | Critical | 9.8 | 2020-01-17 | In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacke… |
CVE-2020-7039 | Medium | 5.6 | 2020-01-16 | tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based… |
CVE-2020-7106 | Medium | 6.1 | 2020-01-16 | Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_a… |
CVE-2020-7044 | High | 7.5 | 2020-01-16 | In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one… |
CVE-2020-2659 | Low | 3.7 | 2020-01-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8… |
CVE-2020-2654 | Low | 3.7 | 2020-01-15 | Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0… |
CVE-2020-2604 | High | 8.1 | 2020-01-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8… |
CVE-2020-2601 | Medium | 6.8 | 2020-01-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231… |
CVE-2020-2593 | Medium | 4.8 | 2020-01-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u23… |
CVE-2020-2590 | Low | 3.7 | 2020-01-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231… |
CVE-2020-2583 | Low | 3.7 | 2020-01-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8… |
CVE-2020-2574 | Medium | 5.9 | 2020-01-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8… |
CVE-2015-2326 | Medium | 5.5 | 2020-01-14 | The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read)… |
CVE-2015-2325 | High | 7.8 | 2020-01-14 | The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap rea… |
CVE-2019-19728 | High | 7.5 | 2020-01-13 | SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges. |
CVE-2019-19727 | Medium | 5.5 | 2020-01-13 | SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions. |
CVE-2020-6377 | High | 8.8 | 2020-01-10 | Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13767 | High | 8.8 | 2020-01-10 | Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2020-1765 | Low | 3.5 | 2020-01-10 | An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce an… |
CVE-2019-20372 | Medium | 5.3 | 2020-01-09 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized… |
CVE-2012-2142 | High | 7.8 | 2020-01-09 | The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a ter… |
CVE-2019-17024 | High | 8.8 | 2020-01-08 | Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2019-17021 | Medium | 5.3 | 2020-01-08 | During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process… |
CVE-2019-17012 | High | 8.8 | 2020-01-08 | Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2019-17011 | High | 7.5 | 2020-01-08 | Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a po… |
CVE-2019-17010 | High | 7.5 | 2020-01-08 | Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-f… |
CVE-2019-17009 | High | 7.8 | 2020-01-08 | When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a… |
CVE-2019-17008 | High | 8.8 | 2020-01-08 | When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects… |
CVE-2019-17005 | High | 8.8 | 2020-01-08 | The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array… |
CVE-2020-6615 | Medium | 6.5 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl). |
CVE-2020-6614 | High | 8.1 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr_read in decode.c. |
CVE-2020-6613 | High | 8.1 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c. |
CVE-2020-6612 | High | 8.1 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy_compressed_bytes in decode_r2007.c. |
CVE-2020-6611 | Medium | 6.5 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c. |
CVE-2020-6610 | Medium | 6.5 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c. |
CVE-2020-6609 | High | 8.8 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c. |
CVE-2019-11745 | High | 8.8 | 2020-01-08 | When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. Th… |
CVE-2019-20367 | Critical | 9.1 | 2020-01-08 | nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). |
CVE-2019-5188 | High | 7.5 | 2020-01-08 | A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-… |
CVE-2019-18179 | Medium | 4.3 | 2020-01-06 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An atta… |
CVE-2019-5846 | Medium | 6.5 | 2020-01-03 | Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2019-5845 | Medium | 6.5 | 2020-01-03 | Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2019-5844 | Medium | 6.5 | 2020-01-03 | Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-5496 | High | 8.8 | 2020-01-03 | FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c. |
CVE-2020-5395 | High | 8.8 | 2020-01-03 | FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. |
CVE-2019-14864 | Medium | 6.5 | 2020-01-02 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumolo… |
CVE-2019-19927 | Medium | 6.0 | 2019-12-31 | In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and performing some operation… |
CVE-2019-20095 | Medium | 5.5 | 2019-12-30 | mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated ho… |
CVE-2019-20053 | Medium | 5.5 | 2019-12-27 | An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file. |
CVE-2019-20015 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec. |
CVE-2019-20014 | High | 8.8 | 2019-12-27 | An issue was discovered in GNU LibreDWG before 0.93. There is a double-free in dwg_free in free.c. |
CVE-2019-20013 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec. |
CVE-2019-20012 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec. |
CVE-2019-20011 | High | 8.8 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decode_R13_R2000 in decode.c. |
CVE-2019-20010 | High | 8.8 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. There is a use-after-free in resolve_objectref_vector in decode.c. |
CVE-2019-20009 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.sp… |
CVE-2012-2736 | Medium | 4.4 | 2019-12-26 | In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network. |
CVE-2019-15695 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due… |
CVE-2019-15694 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to th… |
CVE-2019-15692 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Ex… |
CVE-2019-15691 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routi… |
CVE-2019-19966 | Medium | 4.6 | 2019-12-25 | In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-d… |
CVE-2019-19965 | Medium | 4.7 | 2019-12-25 | In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection durin… |
CVE-2019-19925 | High | 7.5 | 2019-12-24 | zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. |
CVE-2019-19923 | High | 7.5 | 2019-12-24 | flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can… |
CVE-2019-19953 | Critical | 9.1 | 2019-12-24 | In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c. |
CVE-2019-19951 | Critical | 9.8 | 2019-12-24 | In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c. |
CVE-2019-19950 | Critical | 9.8 | 2019-12-24 | In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c. |
CVE-2019-19949 | Critical | 9.1 | 2019-12-24 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and… |
CVE-2019-19948 | Critical | 9.8 | 2019-12-24 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c. |
CVE-2019-12418 | High | 7.0 | 2019-12-23 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access… |
CVE-2019-17563 | High | 7.5 | 2019-12-23 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could per… |
CVE-2019-18391 | Medium | 5.5 | 2019-12-23 | A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to caus… |
CVE-2019-18390 | High | 7.1 | 2019-12-23 | An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of ser… |
CVE-2019-18389 | High | 7.8 | 2019-12-23 | A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to caus… |
CVE-2019-18388 | Medium | 5.5 | 2019-12-23 | A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands. |
CVE-2019-11050 | Medium | 4.8 | 2019-12-23 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 a… |
CVE-2019-11046 | Low | 3.7 | 2019-12-23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into readin… |
CVE-2019-11045 | Low | 3.7 | 2019-12-23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as termin… |
CVE-2019-19926 | High | 7.5 | 2019-12-23 | multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vuln… |
CVE-2019-19918 | High | 7.8 | 2019-12-20 | Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c. |
CVE-2019-19917 | High | 7.8 | 2019-12-20 | Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c. |
CVE-2019-17571 | Critical | 9.8 | 2019-12-20 | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code… |
CVE-2019-16782 | Medium | 6.3 | 2019-12-18 | There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attacker… |
CVE-2019-19880 | High | 7.5 | 2019-12-18 | exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses… |
CVE-2014-8179 | High | 7.5 | 2019-12-17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during… |
CVE-2014-8178 | Medium | 5.5 | 2019-12-17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attac… |
CVE-2019-16779 | Medium | 5.8 | 2019-12-16 | In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would… |
CVE-2014-3495 | High | 7.5 | 2019-12-13 | duplicity 0.6.24 has improper verification of SSL certificates |
CVE-2014-2387 | Medium | 4.4 | 2019-12-13 | Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities |