VYPR
← Debian

Vendor CVEs

Debian

All CVEs

10,437 total · sorted by risk
  • CVE-2012-0876Jul 3, 2012
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.06

    The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the…

  • CVE-2012-3587Jun 19, 2012
    Debian
    Advanced Package Tool
    risk 0.00cvss —epss 0.02

    APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.

  • CVE-2012-0954Jun 19, 2012
    Debian
    Advanced Package Tool
    risk 0.00cvss —epss 0.02

    APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this…

  • CVE-2012-0212Jun 16, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.06

    debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.

  • CVE-2012-0211Jun 16, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.06

    debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.

  • CVE-2012-0210Jun 16, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.05

    debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.

  • CVE-2012-0920Jun 5, 2012
    Dropbear SSH Project
    Dropbear SSH
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests,…

  • CVE-2012-2947Jun 2, 2012
    Asterisk
    Certified Asterisk
    risk 0.00cvss —epss 0.02

    chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash)…

  • CVE-2012-1988May 29, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.03

    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating…

  • CVE-2012-2120May 18, 2012
    Texlive Extra Utils
    latex2man
    risk 0.00cvss —epss 0.00

    latex2man in texlive-extra-utils 2011.20120322, and possibly other versions or packages, when used with the H or T option, allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

  • CVE-2012-0216Apr 22, 2012
    Debian
    linux
    risk 0.00cvss —epss 0.00

    The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct…

  • CVE-2012-0449Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT…

  • CVE-2012-0442Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash)…

  • CVE-2011-4361Jan 8, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated…

  • CVE-2011-4360Jan 8, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.

  • CVE-2011-3919Jan 7, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-3905Dec 13, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3895Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in the Vorbis decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream.

  • CVE-2011-3892Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Double free vulnerability in the Theora decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream.

  • CVE-2011-2834Sep 19, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

  • CVE-2011-2821Aug 29, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted XPath expression.

  • CVE-2011-2818Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to display box rendering.

  • CVE-2011-2800Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.107 allows remote attackers to obtain potentially sensitive information about client-side redirect targets via a crafted web site.

  • CVE-2011-2359Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 13.0.782.107 does not properly track line boxes during rendering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-2688Jul 28, 2011
    Apache
    mod_authnz_external
    risk 0.00cvss —epss 0.06

    SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.

  • CVE-2011-1829Jul 27, 2011
    Debian
    Apt
    risk 0.00cvss —epss 0.02

    APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message.

  • CVE-2011-1526Jul 11, 2011
    Mit
    Krb5 Appl
    risk 0.00cvss —epss 0.04

    ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read…

  • CVE-2011-2192Jul 7, 2011
    Curl
    Libcurl
    risk 0.00cvss —epss 0.03

    The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

  • CVE-2011-1799May 16, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 11.0.696.68 does not properly perform casts of variables during interaction with the WebKit engine, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1444May 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1440May 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the ruby element and Cascading Style Sheets (CSS) token sequences.

  • CVE-2011-1499Apr 29, 2011
    Tinyproxy
    Tinyproxy
    risk 0.00cvss —epss 0.02

    acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.

  • CVE-2011-1548Mar 30, 2011
    File Project
    Logrotate
    risk 0.00cvss —epss 0.00

    The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted…

  • CVE-2011-1176Mar 29, 2011
    Mpm Itk Project
    Mpm Itk
    risk 0.00cvss —epss 0.03

    The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote…

  • CVE-2011-0441Mar 29, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.

  • CVE-2011-1400Mar 25, 2011
    Debian
    linux
    risk 0.00cvss —epss 0.04

    The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote…

  • CVE-2011-1293Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the HTMLCollection implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1292Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the frame-loader implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-0721Feb 19, 2011
    W Shadow
    Shadow
    risk 0.00cvss —epss 0.02

    Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.

  • CVE-2011-0985Feb 10, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 9.0.597.94 does not properly perform process termination upon memory exhaustion, which has unspecified impact and remote attack vectors.

  • CVE-2011-0984Feb 10, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 9.0.597.94 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-0983Feb 10, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 9.0.597.94 does not properly handle anonymous blocks, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-0981Feb 10, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 9.0.597.94 does not properly perform event handling for animations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-0783Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 9.0.597.84 allows user-assisted remote attackers to cause a denial of service (application crash) via vectors involving a "bad volume setting."

  • CVE-2011-0779Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 9.0.597.84 does not properly handle a missing key in an extension, which allows remote attackers to cause a denial of service (application crash) via a crafted extension.

  • CVE-2010-3689Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.01

    soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

  • CVE-2011-0495Jan 20, 2011
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users…

  • CVE-2011-0482Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of anchors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML…

  • CVE-2011-0480Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified…

  • CVE-2011-0474Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown…

Page 200 of 209