Debian Security Vulnerabilities (CVEs)

CVE-2011-4625 is an XML encryption vulnerability in SimpleSAMLphp that allows attackers to decrypt or forge SAML messages. This affects SimpleSAMLphp ...

CVE-2013-6364 is a combined CSRF and XSS vulnerability in Horde Groupware Webmail Edition that allows attackers to execute arbitrary web scripts or pe...

CVE-2017-5332 is a memory corruption vulnerability in icoutils' wrestool component that allows local users to crash processes and potentially execute ...

CVE-2013-4251 is a privilege escalation vulnerability in SciPy's scipy.weave component that creates temporary directories with insecure permissions. T...

This vulnerability allows local users to escape restricted shell sessions and execute arbitrary commands with elevated privileges. It affects systems ...

CVE-2019-18683 is a race condition vulnerability in the Linux kernel's VIVID video driver that can lead to use-after-free conditions. It allows local ...

CVE-2013-4412 is a NULL pointer dereference vulnerability in the slim display manager when using the crypt() method from glibc 2.17. This vulnerabilit...

MiniUPnPd contains an information disclosure vulnerability due to improper use of snprintf() that can leak sensitive memory contents. This affects sys...

This vulnerability allows attackers to cause denial-of-service by exploiting a NULL pointer dereference in Python's X509 certificate parser. When Pyth...

This vulnerability in autojump allows local users to escalate privileges by placing a malicious custom_install directory in the current working direct...

This vulnerability allows ARM guest OS users with administrative privileges to cause a hypervisor crash via specially crafted XENMEM_add_to_physmap hy...

This CVE allows x86 PV guest administrators in Xen hypervisors to exploit race conditions in pagetable promotion/demotion operations, potentially gain...

This vulnerability is an assertion failure in the BIND DNS server's validator component, specifically affecting Debian backports of a previous CVE-201...

CVE-2009-3723 is an access control vulnerability in Asterisk that allows SIP calls to bypass network restrictions. Attackers can make unauthorized cal...

Python keyring library versions before 0.10 created keyring files with world-readable permissions (0666), allowing any user on the system to read stor...

This vulnerability allows remote attackers to execute arbitrary code on PHP servers running vulnerable versions with specific FPM configurations. It a...

A vulnerability in Go's crypto/dsa package causes a panic when processing network traffic containing invalid DSA public keys. This can lead to denial ...

CVE-2019-18408 is a use-after-free vulnerability in libarchive's RAR archive parsing functionality. When processing specially crafted RAR archives, an...

CVE-2019-17498 is an integer overflow vulnerability in libssh2 v1.9.0 and earlier that allows a malicious SSH server to read arbitrary memory from a c...

CVE-2019-18197 is a use-after-free vulnerability in libxslt's XSLT transformation function that can lead to memory corruption. When exploited, it coul...

WordPress sites running versions before 5.2.4 are vulnerable to cache poisoning attacks on JSON GET requests due to missing Vary: Origin headers. This...

This is a Cross-Site Request Forgery (CSRF) vulnerability in WordPress admin pages that occurs due to type confusion during referer validation. Attack...

This vulnerability is a buffer overflow in the Linux kernel's Realtek wireless driver (rtlwifi) due to missing bounds checking in the rtl_p2p_noa_ie f...

CVE-2019-17533 is a heap-based buffer over-read vulnerability in MATIO library versions before 1.5.18. It allows attackers to read uninitialized memor...

CVE-2019-2215 is a use-after-free vulnerability in Android's Binder inter-process communication driver that allows a malicious local application to ga...

This vulnerability in Ansible Engine allows credential disclosure through DEBUG-level logging when plugins use libraries that log credentials at that ...

This vulnerability in Xen hypervisor allows x86 guest OS users to cause denial of service or potentially gain elevated privileges by exploiting mishan...

This CVE describes a race condition vulnerability in Xen's XENMEM_exchange hypercall that allows x86 PV guest OS users to cause denial of service or p...

This vulnerability in Xen hypervisor allows x86 PV (paravirtualized) guest operating systems to cause denial of service or potentially gain elevated p...

CVE-2018-14879 is a buffer overflow vulnerability in tcpdump's command-line argument parser that allows attackers to execute arbitrary code or cause d...

This vulnerability is a buffer over-read in tcpdump's BGP parser that allows attackers to cause denial of service or potentially leak memory contents....

This vulnerability is a buffer over-read in tcpdump's IEEE 802.11 parser when processing Mesh Flags subfields. It allows attackers to cause denial of ...

This vulnerability in tcpdump's DCCP parser allows attackers to cause a buffer over-read when processing malicious network packets. Systems running vu...

This vulnerability is a buffer over-read in tcpdump's SMB parser that could allow attackers to cause denial of service or potentially leak memory cont...

This vulnerability in tcpdump's LDP parser allows attackers to trigger a buffer over-read when processing specially crafted LDP packets. Systems runni...

CVE-2018-14463 is a buffer over-read vulnerability in tcpdump's VRRP parser that could allow attackers to cause denial of service or potentially leak ...

CVE-2018-14465 is a buffer over-read vulnerability in the RSVP parser of tcpdump, a network packet analyzer. It allows attackers to cause denial-of-se...

This vulnerability in tcpdump's BGP parser allows attackers to cause a buffer over-read when processing specially crafted BGP packets. Systems running...