Debian Linux vulnerabilities

CVE-2018-7439 [HIGH] CWE-125 CVE-2018-7439: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the functi An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the function read_mini_biff_next_record.

CVE-2018-7435 [HIGH] CWE-125 CVE-2018-7435: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function.

CVE-2018-7437 [HIGH] CWE-125 CVE-2018-7437: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy c An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function.

CVE-2018-7438 [HIGH] CWE-125 CVE-2018-7438: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_ An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_unicode_string function.

CVE-2021-21222 [MEDIUM] CWE-787 CVE-2021-21222: Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

CVE-2017-1000472 [MEDIUM] CWE-22 CVE-2017-1000472: The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "fil

CVE-2021-3640 [HIGH] CWE-362 CVE-2021-3640: A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the

CVE-2020-28972 [MEDIUM] CWE-295 CVE-2020-28972: In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.

CVE-2010-4164 [HIGH] CVE-2010-4164: Multiple integer underflows in the x25_parse_facilities function in net/x25/x25_facilities.c in the Multiple integer underflows in the x25_parse_facilities function in net/x25/x25_facilities.c in the Linux kernel before 2.6.36.2 allow remote attackers to cause a denial of service (system crash) via malformed X.25 (1) X25_FAC_CLASS_A, (2) X25_FAC_CLASS_B, (3) X25_FAC_CLASS_C, or (4) X25_FAC_CLASS_D facility data, a different vulnerability than CVE-2010-3873.

CVE-2023-1872 [HIGH] CWE-416 CVE-2023-1872: A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit da24142b1ef9fd5d3

CVE-2018-12564 [MEDIUM] CWE-20 CVE-2018-12564: An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submi An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml.

CVE-2024-3096 [MEDIUM] CWE-20 CVE-2024-3096: In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored w In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

CVE-2023-34969 [MEDIUM] CWE-404 CVE-2023-34969: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user w D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstance

CVE-2019-12469 [MEDIUM] CWE-862 CVE-2019-12469: MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTag MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

CVE-2015-1414 [HIGH] CVE-2015-1414: Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.

CVE-2016-1628 [MEDIUM] CWE-119 CVE-2016-1628: pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certa pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functi

CVE-2019-12470 [MEDIUM] CWE-862 CVE-2019-12470: Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete pa Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

CVE-2012-1988 [MEDIUM] CWE-78 CVE-2012-1988: Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a

CVE-2021-3667 [MEDIUM] CWE-667 CVE-2021-3667: An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occur An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock

CVE-2015-3414 [HIGH] CWE-908 CVE-2015-3414: SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which all SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.