Debian Linux vulnerabilities

CVE-2019-15215 [MEDIUM] CWE-416 CVE-2019-15215: An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a mali An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.

CVE-2017-3533 [LOW] CVE-2017-3533: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: N Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded

CVE-2015-3336 [MEDIUM] CWE-264 CVE-2015-3336: Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTIN Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes, which allows user-assisted remote attackers to cause a denial of service (UI disruption) by constructing a crafted HTML document containing JavaScript code with requestFullScreen and reques

CVE-2018-6047 [MEDIUM] CWE-20 CVE-2018-6047: Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote at Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted HTML page.

CVE-2019-19966 [MEDIUM] CWE-416 CVE-2019-19966: In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpi In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-dea37a972655.

CVE-2017-13721 [MEDIUM] CWE-269 CVE-2017-13721: In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X serve In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause aborts of the X server or replace shared memory segments of other X clients in the same session.

CVE-2025-38365 [MEDIUM] CWE-362 CVE-2025-38365: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renam In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and directory logging We have a race between a rename and directory inode logging that if it happens and we crash/power fail before the rename completes, the next time the filesystem is mounted, the log replay code will end up deleting the file tha

CVE-2010-4493 [MEDIUM] CWE-416 CVE-2010-4493: Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service via vectors related to the handling of mouse dragging events.

CVE-2012-0049 [MEDIUM] CWE-400 CVE-2012-0049: OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joinin OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.

CVE-2016-1626 [MEDIUM] CWE-119 CVE-2016-1626: The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.

CVE-2022-33744 [MEDIUM] CVE-2022-33744: Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an r Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. Th

CVE-2022-3303 [MEDIUM] CWE-667 CVE-2022-3303: A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It coul A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition

CVE-2023-52489 [MEDIUM] CWE-362 CVE-2023-52489: In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in acces In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains

CVE-2014-3611 [MEDIUM] CWE-362 CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.

CVE-2023-42756 [MEDIUM] CWE-362 CVE-2023-42756: A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.

CVE-2018-6051 [MEDIUM] CWE-79 CVE-2018-6051: XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the sam XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page.

CVE-2018-6048 [MEDIUM] CWE-20 CVE-2018-6048: Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote at Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a crafted HTML page.

CVE-2021-28964 [MEDIUM] CWE-362 CVE-2021-28964: A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11 A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.

CVE-2022-39188 [MEDIUM] CWE-362 CVE-2022-39188: An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a r An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.

CVE-2019-19947 [MEDIUM] CWE-908 CVE-2019-19947: In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB devi In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.