Debian Linux vulnerabilities

CVE-2021-35561 [MEDIUM] CVE-2021-35561: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compr

CVE-2018-5388 [MEDIUM] CWE-124 CVE-2018-5388: In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer un In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket.

CVE-2020-20451 [HIGH] CWE-401 CVE-2020-20451: Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c. Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.

CVE-2023-4781 [HIGH] CWE-122 CVE-2023-4781: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.

CVE-2014-1936 [HIGH] CWE-20 CVE-2014-1936: rc before 1.7.1-5 insecurely creates temporary files. rc before 1.7.1-5 insecurely creates temporary files.

CVE-2023-4738 [HIGH] CWE-122 CVE-2023-4738: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.

CVE-2023-4752 [HIGH] CWE-416 CVE-2023-4752: Use After Free in GitHub repository vim/vim prior to 9.0.1858. Use After Free in GitHub repository vim/vim prior to 9.0.1858.

CVE-2011-0529 [HIGH] CWE-20 CVE-2011-0529: Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP. Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP.

CVE-2018-8005 [MEDIUM] CWE-400 CVE-2018-8005: When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgr

CVE-2021-35586 [MEDIUM] CVE-2021-35586: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compr

CVE-2022-3324 [HIGH] CWE-121 CVE-2022-3324: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.

CVE-2017-12874 [HIGH] CWE-20 CVE-2017-12874: The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an in The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

CVE-2023-41358 [HIGH] CWE-476 CVE-2023-41358: An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attri An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

CVE-2022-29824 [MEDIUM] CWE-190 CVE-2022-29824: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is af

CVE-2018-6555 [HIGH] CWE-416 CVE-2018-6555: The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c i The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket.

CVE-2016-4565 [HIGH] CWE-264 CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write syste The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.

CVE-2022-1925 [HIGH] CWE-122 CVE-2022-1925: DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.

CVE-2021-3910 [HIGH] CWE-20 CVE-2021-3910: OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0 OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

CVE-2021-34055 [HIGH] CWE-120 CVE-2021-34055: jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u. jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u.

CVE-2017-3244 [MEDIUM] CVE-2017-3244: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported v Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulner