Filtered by vendor Debian Subscriptions
Filtered by product Debian Linux Subscriptions
Total 9957 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-0308 3 Debian, Google, Redhat 4 Debian Linux, Android, Enterprise Linux and 1 more 2024-11-21 6.8 Medium
In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-158063095.
CVE-2021-0129 4 Bluez, Debian, Linux and 1 more 4 Bluez, Debian Linux, Linux Kernel and 1 more 2024-11-21 5.7 Medium
Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.
CVE-2021-0089 3 Debian, Fedoraproject, Intel 12 Debian Linux, Fedora, Celeron Processors and 9 more 2024-11-21 6.5 Medium
Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVE-2020-9951 4 Apple, Debian, Redhat and 1 more 11 Icloud, Ipados, Iphone Os and 8 more 2024-11-21 8.8 High
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2020-9948 4 Apple, Debian, Redhat and 1 more 5 Safari, Debian Linux, Enterprise Linux and 2 more 2024-11-21 8.8 High
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2020-9760 2 Debian, Weechat 2 Debian Linux, Weechat 2024-11-21 9.8 Critical
An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick.
CVE-2020-9549 2 Debian, Pdfresurrect Project 2 Debian Linux, Pdfresurrect 2024-11-21 7.8 High
In PDFResurrect 0.12 through 0.19, get_type in pdf.c has an out-of-bounds write via a crafted PDF document.
CVE-2020-9548 5 Debian, Fasterxml, Netapp and 2 more 36 Debian Linux, Jackson-databind, Active Iq Unified Manager and 33 more 2024-11-21 9.8 Critical
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547 5 Debian, Fasterxml, Netapp and 2 more 28 Debian Linux, Jackson-databind, Active Iq Unified Manager and 25 more 2024-11-21 9.8 Critical
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2020-9546 5 Debian, Fasterxml, Netapp and 2 more 42 Debian Linux, Jackson-databind, Active Iq Unified Manager and 39 more 2024-11-21 9.8 Critical
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVE-2020-9498 3 Apache, Debian, Fedoraproject 3 Guacamole, Debian Linux, Fedora 2024-11-21 6.7 Medium
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed with the privileges of therunning guacd process.
CVE-2020-9497 3 Apache, Debian, Fedoraproject 3 Guacamole, Debian Linux, Fedora 2024-11-21 4.4 Medium
Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or compromised RDP server, specially-craftedPDUs could result in disclosure of information within the memory ofthe guacd process handling the connection.
CVE-2020-9494 2 Apache, Debian 2 Traffic Server, Debian Linux 2024-11-21 7.5 High
Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.
CVE-2020-9490 7 Apache, Canonical, Debian and 4 more 28 Http Server, Ubuntu Linux, Debian Linux and 25 more 2024-11-21 7.5 High
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
CVE-2020-9488 5 Apache, Debian, Oracle and 2 more 53 Log4j, Debian Linux, Communications Application Session Controller and 50 more 2024-11-21 3.7 Low
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
CVE-2020-9484 8 Apache, Canonical, Debian and 5 more 30 Tomcat, Ubuntu Linux, Debian Linux and 27 more 2024-11-21 7.0 High
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
CVE-2020-9481 2 Apache, Debian 2 Traffic Server, Debian Linux 2024-11-21 7.5 High
Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.
CVE-2020-9431 4 Debian, Fedoraproject, Opensuse and 1 more 4 Debian Linux, Fedora, Leap and 1 more 2024-11-21 7.5 High
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.
CVE-2020-9430 4 Debian, Fedoraproject, Opensuse and 1 more 4 Debian Linux, Fedora, Leap and 1 more 2024-11-21 7.5 High
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c by validating a length field.
CVE-2020-9428 4 Debian, Fedoraproject, Opensuse and 1 more 4 Debian Linux, Fedora, Leap and 1 more 2024-11-21 7.5 High
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.