DEBIAN-CVE-2023-2905

Due to a failure in validating the length of a provided MQTTCMDPUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not...

DEBIAN-CVE-2023-4077

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

DEBIAN-CVE-2022-4918

Use after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2023-29454

Stored or persistent cross-site scripting XSS is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload e.g., in a database or server-side text files, and finally, the application unintentionally executes the payload for every victi...

DEBIAN-CVE-2023-3108

A flaw was found in the subsequent getuserpagesfast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipherrecvmsg of crypto/algifskcipher.c function. This flaw allows a local user to crash the system...

DEBIAN-CVE-2023-36661

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows...

DEBIAN-CVE-2023-3220

An issue was discovered in the Linux kernel through 6.1-rc8. dpucrtcatomiccheck in drivers/gpu/drm/msm/disp/dpu1/dpucrtc.c lacks check of the return value of kzalloc and will cause the NULL Pointer Dereference...

DEBIAN-CVE-2023-34410

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate...

DEBIAN-CVE-2023-2251

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5...

DEBIAN-CVE-2023-1814

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass download checking via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2023-1170

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376...

DEBIAN-CVE-2023-25362

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely...

DEBIAN-CVE-2023-0933

Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Chromium security severity: Medium...

DEBIAN-CVE-2023-23145

GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsrreadrarefull function...

DEBIAN-CVE-2023-23144

Integer overflow vulnerability in function QDecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master...

DEBIAN-CVE-2022-42258

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko, where an integer overflow may lead to denial of service, data tampering, or information disclosure...

DEBIAN-CVE-2022-40899

An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server...

DEBIAN-CVE-2022-45416

Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

DEBIAN-CVE-2022-31737

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

DEBIAN-CVE-2022-29911

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...