Debian Security Vulnerabilities (CVEs)

This CVE describes a denial-of-service vulnerability in Wireshark's BACapp dissector where excessive recursion could cause the application to crash. I...

This vulnerability in Varnish Cache causes assertion failures and daemon restarts when using PROXY version 2 protocol with TLS termination proxies. Th...

This is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution when untrusted data is deserialized with polym...

CVE-2020-11612 is a memory allocation vulnerability in Netty's ZlibDecoders that allows attackers to cause denial of service through memory exhaustion...

CVE-2019-14868 is a command injection vulnerability in ksh (KornShell) that allows attackers to bypass environment restrictions and execute arbitrary ...

This vulnerability allows remote attackers to write arbitrary bytes to heap memory via a crafted HTTP/2 request to HAProxy's HPACK decoder. Successful...

A buffer overflow vulnerability in PHP's mb_strtolower() function when using UTF-32LE encoding allows attackers to corrupt memory. This could lead to ...

This vulnerability in Bubblewrap (bwrap) allows local attackers to gain root privileges when the software is installed in setuid mode and the kernel s...

A heap use-after-free vulnerability in systemd before version v245-rc1 allows local unprivileged attackers to crash systemd services or potentially ex...

This CVE allows remote code execution through deserialization of untrusted data in FasterXML jackson-databind. It affects applications using Jackson 2...

This is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution when processing untrusted JSON content. It aff...

This vulnerability in FasterXML jackson-databind allows remote code execution (RCE) via deserialization of untrusted data, exploiting a gadget chain i...

CVE-2020-6071 is a denial-of-service vulnerability in Videolabs libmicrodns 0.1.0 where improper handling of compressed labels in mDNS messages allows...

CVE-2020-6077 is an out-of-bounds read vulnerability in Videolabs libmicrodns 0.1.0 that allows remote attackers to cause denial of service by sending...

CVE-2020-6079 is a memory leak vulnerability in libmicrodns 0.1.0 that allows denial-of-service attacks via resource exhaustion. An attacker can repea...

This vulnerability in Ansible Engine allows attackers to manipulate ansible_facts data when using specific configurations, potentially leading to priv...

This is a use-after-free vulnerability in Chrome's WebGL implementation that allows remote attackers to potentially exploit heap corruption. Attackers...

This is a use-after-free vulnerability in Chrome's audio component that allows remote attackers to potentially exploit heap corruption. Attackers can ...

This is a use-after-free vulnerability in Chrome's audio component that allows remote attackers to potentially exploit heap corruption. Attackers can ...

This SQL injection vulnerability in phpMyAdmin allows attackers to execute arbitrary SQL queries by crafting malicious database or table names. Users ...

CVE-2020-10672 is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution when processing untrusted JSON conte...

CVE-2020-0556 is an improper access control vulnerability in BlueZ (Linux Bluetooth stack) that allows unauthenticated attackers within Bluetooth rang...

This CVE describes an integer overflow leading to heap-based buffer overflow in ICU's UnicodeString::doAppend() function. Attackers can exploit this t...

This CVE describes an out-of-bounds read vulnerability in Android's VP8 video decoder. An attacker could remotely disclose information from affected d...

CVE-2020-5258 is a prototype pollution vulnerability in the Dojo Toolkit's deepCopy method that allows attackers to inject malicious properties into J...

This CVE allows SQL injection in Django when untrusted data is used as the tolerance parameter in GIS functions and aggregates on Oracle databases. At...

CVE-2020-8659 is a memory exhaustion vulnerability in CNCF Envoy proxy that allows attackers to cause denial of service by sending HTTP/1.1 requests w...

This vulnerability is a type confusion flaw in Chrome's V8 JavaScript engine that allows a remote attacker to potentially exploit heap corruption via ...

This is a use-after-free vulnerability in the speech component of Google Chrome that allows a remote attacker to potentially exploit heap corruption v...

This vulnerability is a type confusion flaw in Chrome's V8 JavaScript engine that allows an attacker to execute arbitrary code or cause heap corruptio...

This CVE describes a null pointer dereference vulnerability in PHP's file upload progress tracking feature. When upload progress tracking is enabled w...

CVE-2020-9274 is an uninitialized pointer vulnerability in Pure-FTPd 1.0.49 that can cause denial of service or potentially allow arbitrary code execu...

This vulnerability in the Linux kernel's floppy driver allows an out-of-bounds read when accessing the Floppy Disk Controller (FDC) index without prop...

This vulnerability in Go's SSH package allows attackers to cause denial of service through panic during signature verification. Both SSH servers accep...

CVE-2020-9273 is a use-after-free vulnerability in ProFTPD 1.3.7 that allows remote attackers to corrupt memory pools by interrupting data transfer ch...