Debian Linux Security Vulnerabilities
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and pr...
4.9CVSS
6AI Score
0.001EPSS
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.
7.8CVSS
8AI Score
0.005EPSS
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
3.3CVSS
3.7AI Score
0.001EPSS
Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.
8.1CVSS
7.8AI Score
0.003EPSS
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
7.5CVSS
7.2AI Score
0.003EPSS
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/tif_dir.c'.
6.5CVSS
6.2AI Score
0.005EPSS
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
6.5CVSS
6.5AI Score
0.004EPSS
Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.
6.5CVSS
6.3AI Score
0.004EPSS
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
6.1CVSS
6.7AI Score
0.003EPSS
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse prox...
4.8CVSS
7.4AI Score
0.002EPSS
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
9.8CVSS
9.2AI Score
0.002EPSS
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
9.8CVSS
7.1AI Score
0.016EPSS
A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
5.5CVSS
5.5AI Score
0.001EPSS
A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
5.5CVSS
5.5AI Score
0.001EPSS
Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
9.8CVSS
9.3AI Score
0.007EPSS
Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers to cause a denial of service.
5.5CVSS
6AI Score
0.001EPSS
Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.
7.8CVSS
7.6AI Score
0.001EPSS
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorit...
7.5CVSS
7.3AI Score
0.081EPSS
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted com...
3.7CVSS
3.9AI Score
0.006EPSS
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrec...
5.9CVSS
5.5AI Score
0.004EPSS
A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).
6.5CVSS
6.4AI Score
0.001EPSS
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
7.5CVSS
6.5AI Score
0.001EPSS
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service.
6.5CVSS
7.5AI Score
0.015EPSS
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.
6.5CVSS
7.5AI Score
0.017EPSS
FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service.
7.5CVSS
8.2AI Score
0.001EPSS
Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.
7.5CVSS
8.2AI Score
0.002EPSS
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service
6.5CVSS
7.5AI Score
0.015EPSS
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
5.3CVSS
5.3AI Score
0.004EPSS
PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().
7.8CVSS
7.4AI Score
0.001EPSS
Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service
7.5CVSS
8.2AI Score
0.003EPSS
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
7.5CVSS
6.9AI Score
0.005EPSS
fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c.
5.5CVSS
5.7AI Score
0.001EPSS
fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c.
5.5CVSS
5.4AI Score
0.001EPSS
fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c.
5.5CVSS
5.7AI Score
0.001EPSS
fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c.
5.5CVSS
5.7AI Score
0.001EPSS
fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c.
5.5CVSS
5.7AI Score
0.001EPSS
fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c.
5.5CVSS
5.7AI Score
0.001EPSS
fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c.
5.5CVSS
5.4AI Score
0.001EPSS
libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file.
6.5CVSS
7.2AI Score
0.003EPSS
libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file.
6.5CVSS
7.2AI Score
0.004EPSS
libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file.
8.8CVSS
8.5AI Score
0.004EPSS
libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file.
6.5CVSS
7.2AI Score
0.002EPSS
A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ptk format.
5.5CVSS
5.9AI Score
0.001EPSS
A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format.
5.5CVSS
5.6AI Score
0.001EPSS
A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code.
8.8CVSS
8.7AI Score
0.003EPSS
A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file.
6.5CVSS
6.9AI Score
0.001EPSS
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
5.5CVSS
5.7AI Score
0.001EPSS
Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive information, cause a Denial of Service, or execute arbitrary code.
8.8CVSS
9.3AI Score
0.026EPSS