VYPR
← Debian

Vendor CVEs

Debian

All CVEs

10,468 total · sorted by risk
  • CVE-2014-9771HigMay 13, 2016
    Enlightenment
    Imlib2
    risk 0.49cvss 7.5epss 0.03

    Integer overflow in imlib2 before 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted image, which triggers an invalid read operation.

  • CVE-2014-9764HigMay 13, 2016
    Enlightenment
    Imlib2
    risk 0.49cvss 7.5epss 0.03

    imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.

  • CVE-2014-9763HigMay 13, 2016
    Enlightenment
    Imlib2
    risk 0.49cvss 7.5epss 0.03

    imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file.

  • CVE-2014-9762HigMay 13, 2016
    Enlightenment
    Imlib2
    risk 0.49cvss 7.5epss 0.03

    imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.

  • CVE-2011-5326HigMay 13, 2016
    Enlightenment
    Imlib2
    risk 0.49cvss 7.5epss 0.03

    imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.

  • CVE-2016-2849HigMay 13, 2016
    Botan Project
    Botan
    risk 0.49cvss 7.5epss 0.02

    Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.

  • CVE-2016-2194HigMay 13, 2016
    Botan Project
    Botan
    risk 0.49cvss 7.5epss 0.03

    The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.

  • CVE-2015-7827HigMay 13, 2016
    Botan Project
    Botan
    risk 0.49cvss 7.5epss 0.02

    Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.

  • CVE-2015-5727HigMay 13, 2016
    Botan Project
    Botan
    risk 0.49cvss 7.5epss 0.01

    The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.

  • CVE-2015-5726HigMay 13, 2016
    Botan Project
    Botan
    risk 0.49cvss 7.5epss 0.01

    The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data.

  • CVE-2015-8806HigApr 13, 2016
    Xmlsoft
    Libxml2
    risk 0.49cvss 7.5epss 0.05

    dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

  • CVE-2015-3146HigApr 13, 2016
    Libssh
    Libssh
    risk 0.49cvss 7.5epss 0.04

    The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.

  • CVE-2015-8080HigApr 13, 2016
    Redis
    Redis
    risk 0.49cvss 7.5epss 0.05

    Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly…

  • CVE-2016-3163HigApr 12, 2016
    Drupal
    Drupal
    risk 0.49cvss 7.5epss 0.01

    The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.

  • CVE-2015-8702HigApr 12, 2016
    Inspircd
    Inspircd
    risk 0.49cvss 8.6epss 0.02

    The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.

  • CVE-2012-6700HigApr 11, 2016
    Dhcpcd Project
    Dhcpcd
    risk 0.49cvss 7.5epss 0.02

    The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a denial of service via a crafted response.

  • CVE-2012-6699HigApr 11, 2016
    Dhcpcd Project
    Dhcpcd
    risk 0.49cvss 7.5epss 0.02

    The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.

  • CVE-2012-6698HigApr 11, 2016
    Dhcpcd Project
    Dhcpcd
    risk 0.49cvss 7.5epss 0.02

    The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.

  • CVE-2016-2381HigApr 8, 2016
    Perl Foundation
    Perl
    risk 0.49cvss 7.5epss 0.09

    Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

  • CVE-2016-1285MedMar 9, 2016
    Isc
    Bind
    risk 0.49cvss 6.8epss 0.59

    named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka…

  • CVE-2016-0773HigFeb 17, 2016
    PostgreSQL
    PostgreSQL
    risk 0.49cvss 7.5epss 0.07

    PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.

  • CVE-2016-1232HigJan 12, 2016
    Prosody
    Prosody
    risk 0.49cvss 7.5epss 0.02

    The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.

  • CVE-2015-8467HigDec 29, 2015
    Samba (software)
    Samba
    risk 0.49cvss 7.5epss 0.03

    The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote…

  • CVE-2015-7540HigDec 29, 2015
    Samba (software)
    Samba
    risk 0.49cvss 7.5epss 0.07

    The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.

  • CVE-2015-6855HigNov 6, 2015
    QEMU
    Qemu
    risk 0.49cvss 7.5epss 0.04

    hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty…

  • CVE-2015-7236HigOct 1, 2015
    Rpcbind
    Rpcbind
    risk 0.49cvss 7.5epss 0.06

    Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

  • CVE-2014-1505HigMar 19, 2014
    Mozilla Corporation
    Firefox
    risk 0.49cvss 7.5epss 0.04

    The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read…

  • CVE-2014-1487HigFeb 6, 2014
    Mozilla Corporation
    Firefox
    risk 0.49cvss 7.5epss 0.02

    The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error…

  • CVE-2014-1481HigFeb 6, 2014
    Mozilla Corporation
    Firefox
    risk 0.49cvss 7.5epss 0.04

    Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.

  • CVE-2014-1479HigFeb 6, 2014
    Mozilla Corporation
    Firefox
    risk 0.49cvss 7.5epss 0.05

    The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content…

  • CVE-2013-4508HigNov 8, 2013
    Lighttpd
    Lighttpd
    risk 0.49cvss 7.5epss 0.03

    lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.

  • CVE-2012-1610HigJun 5, 2012
    ImageMagick
    Imagemagick
    risk 0.49cvss 7.5epss 0.05

    Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image. NOTE: this vulnerability exists…

  • CVE-2010-4577HigDec 22, 2010
    Google
    Chrome
    risk 0.49cvss 7.5epss 0.02

    The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which…

  • CVE-2010-2073HigJun 16, 2010
    Debian
    Pyftpd
    risk 0.49cvss 7.5epss 0.02

    auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers to read arbitrary files from the FTP server.

  • CVE-2010-1437HigMay 7, 2010
    Linux
    Kernel
    risk 0.49cvss 7.0epss 0.01

    Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands…

  • CVE-2009-3553HigNov 20, 2009
    Apple Inc.
    Cups
    risk 0.49cvss 7.5epss 0.04

    Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client…

  • CVE-2009-1837HigJun 12, 2009
    Mozilla Corporation
    Firefox
    risk 0.49cvss 7.5epss 0.04

    Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free…

  • CVE-2009-1955HigJun 8, 2009
    Apache
    HTTP Server
    risk 0.49cvss 7.5epss 0.53

    The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document…

  • CVE-2008-0063HigMar 19, 2008
    Mit
    Kerberos 5
    risk 0.49cvss 7.5epss 0.03

    The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

  • CVE-2007-3409HigJun 26, 2007
    Net DNS
    Net DNS
    risk 0.49cvss 7.5epss 0.03

    Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

  • CVE-2007-0897HigFeb 16, 2007
    ClamAV
    Clamav
    risk 0.49cvss 7.5epss 0.03

    Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a…

  • CVE-2006-5051HigSep 27, 2006
    Apple Inc.
    Mac OS X
    risk 0.49cvss 8.1epss 0.45

    Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.

  • CVE-2005-1920HigJul 26, 2005
    KDE
    Kde
    risk 0.49cvss 7.5epss 0.04

    The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original file, which could allow local users and possibly remote attackers to obtain sensitive information.

  • CVE-2004-0458HigSep 28, 2004
    Mah Jong
    mah-jong
    risk 0.49cvss 7.5epss 0.03

    mah-jong before 1.6.2 allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null pointer dereference.

  • CVE-2002-1372HigDec 26, 2002
    Apple Inc.
    Cups
    risk 0.49cvss 7.5epss 0.03

    Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not…

  • CVE-2002-0401HigJun 18, 2002
    Ethereal Group
    Ethereal
    risk 0.49cvss 7.5epss 0.06

    SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer.

  • CVE-2024-55581HigFeb 26, 2025
    Adacore
    Ada Web Server
    risk 0.48cvss 7.4epss 0.00

    When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate (unless the using program specifies a TLS configuration).

  • CVE-2024-50302MedKEVNov 19, 2024
    Linux
    Kernel
    risk 0.48cvss 5.5epss 0.01

    In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak…

  • CVE-2023-50868HigFeb 14, 2024
    Isc
    Bind
    risk 0.48cvss 7.5epss 0.82

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC…

  • CVE-2024-20952HigJan 16, 2024
    NetApp
    Oncommand Insight
    risk 0.48cvss 7.4epss 0.01

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9,…

Page 75 of 210