Debian Linux vulnerabilities

CVE-2018-16152 [HIGH] CVE-2018-16152: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, wh

CVE-2024-56374 [HIGH] CWE-770 CVE-2024-56374: An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack o An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.fo

CVE-2020-4067 [HIGH] CWE-665 CVE-2020-4067: In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initial In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This

CVE-2015-8971 [HIGH] CVE-2015-8971: Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that mo Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal, a similar issue to CVE-2003-0063.

CVE-2022-39377 [HIGH] CWE-120 CVE-2022-39377: sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in v sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated f

CVE-2022-24792 [HIGH] CWE-835 CVE-2022-24792: PJSIP is a free and open source multimedia communication library written in C. A denial-of-service v PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not

CVE-2019-18890 [MEDIUM] CWE-89 CVE-2019-18890: A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.

CVE-2023-27530 [HIGH] CWE-400 CVE-2023-27530: A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multi A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

CVE-2017-14160 [HIGH] CWE-119 CVE-2017-14160: The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cau The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.

CVE-2023-52434 [HIGH] CWE-119 CVE-2023-52434: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff88811

CVE-2016-5116 [CRITICAL] CWE-119 CVE-2016-5116: gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x co gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

CVE-2018-0493 [HIGH] CWE-416 CVE-2018-0493: remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sud remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution.

CVE-2020-21365 [HIGH] CWE-22 CVE-2020-21365: Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read loca Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.

CVE-2019-18625 [HIGH] CVE-2019-18625: An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature b An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp op

CVE-2017-7652 [HIGH] CWE-789 CVE-2017-7652: In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening t

CVE-2020-5291 [HIGH] CWE-648 CVE-2020-5291: Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivi Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in set

CVE-2018-1086 [HIGH] CWE-20 CVE-2018-1086: pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interfa pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

CVE-2010-0748 [CRITICAL] CWE-20 CVE-2010-0748: Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have ot Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.

CVE-2024-26141 [HIGH] CWE-400 CVE-2024-26141: Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to r Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applicat

CVE-2017-18509 [HIGH] CWE-20 CVE-2017-18509: An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific s An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC c