Debian » Debian Linux : Security Vulnerabilities (CVSS score between 7 and 7.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2022-34918	843	Overflow	2022-07-04	2022-10-26	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
2	CVE-2022-33980		Exec Code	2022-07-06	2022-12-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
3	CVE-2022-32250	416		2022-06-02	2022-09-09	7.2	None	Local	Low	Not required	Complete	Complete	Complete
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
4	CVE-2022-32207	276		2022-07-07	2023-01-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended.
5	CVE-2022-31799	755		2022-06-02	2022-12-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Bottle before 0.12.20 mishandles errors during early request binding.
6	CVE-2022-31214	269	+Priv	2022-06-09	2022-10-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.
7	CVE-2022-31087	74	Exec Code +Priv	2022-06-27	2022-07-07	7.2	None	Local	Low	Not required	Complete	Complete	Complete
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory.
8	CVE-2022-31003	787	Exec Code	2022-05-31	2022-12-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
9	CVE-2022-30785			2022-05-26	2023-01-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
10	CVE-2022-29599	77		2022-05-23	2022-10-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
11	CVE-2022-29581	416		2022-05-17	2022-10-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
12	CVE-2022-29155	89	Sql	2022-05-04	2022-10-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
13	CVE-2022-28893	416		2022-04-11	2022-10-08	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
14	CVE-2022-28347	89	Sql Bypass	2022-04-12	2022-11-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
15	CVE-2022-28346	89	Sql	2022-04-12	2022-11-07	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
16	CVE-2022-28044	787	Mem. Corr.	2022-04-15	2022-07-22	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.
17	CVE-2022-27239	787	Overflow +Priv	2022-04-27	2022-10-05	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.
18	CVE-2022-26691	269	+Priv	2022-05-26	2022-10-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
19	CVE-2022-26651	89	Sql	2022-04-15	2023-02-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.
20	CVE-2022-26520			2022-03-10	2022-11-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DISPUTED In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.
21	CVE-2022-26496	787	Overflow	2022-03-06	2022-04-25	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.
22	CVE-2022-26495	190	Overflow	2022-03-06	2022-04-25	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists for the NBD_OPT_INFO, NBD_OPT_GO, and NBD_OPT_EXPORT_NAME messages.
23	CVE-2022-26364			2022-06-09	2022-08-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.
24	CVE-2022-26363			2022-06-09	2022-08-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.
25	CVE-2022-25315	190	Overflow	2022-02-18	2022-10-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
26	CVE-2022-25236	668		2022-02-16	2022-10-07	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
27	CVE-2022-25235	116		2022-02-16	2022-10-07	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
28	CVE-2022-24786	125		2022-04-06	2023-02-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
29	CVE-2022-24754	120	Overflow	2022-03-11	2022-11-16	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
30	CVE-2022-24300	74		2022-02-02	2022-02-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.
31	CVE-2022-23943	787		2022-03-14	2022-10-26	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
32	CVE-2022-23852	190	Overflow	2022-01-24	2022-10-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
33	CVE-2022-23772	190	Overflow	2022-02-11	2022-11-09	7.8	None	Remote	Low	Not required	None	None	Complete
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
34	CVE-2022-23614	74		2022-02-04	2022-04-18	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.
35	CVE-2022-23608	416		2022-02-22	2023-02-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
36	CVE-2022-23222	476	+Priv	2022-01-14	2022-10-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types.
37	CVE-2022-23219	120	DoS Exec Code Overflow	2022-01-14	2022-11-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
38	CVE-2022-23218	120	DoS Exec Code Overflow	2022-01-14	2022-11-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
39	CVE-2022-22824	190	Overflow	2022-01-10	2022-10-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
40	CVE-2022-22823	190	Overflow	2022-01-10	2022-10-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
41	CVE-2022-22822	190	Overflow	2022-01-10	2022-10-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
42	CVE-2022-22817			2022-01-10	2023-01-31	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used,
43	CVE-2022-22720	444		2022-03-14	2022-11-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
44	CVE-2022-21724	665	Exec Code	2022-02-02	2022-11-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.
45	CVE-2022-20785	401	DoS	2022-05-04	2022-07-01	7.8	None	Remote	Low	Not required	None	None	Complete
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.
46	CVE-2022-20771		DoS	2022-05-04	2022-07-01	7.8	None	Remote	Low	Not required	None	None	Complete
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in the TIFF file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.
47	CVE-2022-20770		DoS	2022-05-04	2022-07-01	7.8	None	Remote	Low	Not required	None	None	Complete
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.
48	CVE-2022-1679	416		2022-05-16	2022-12-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.
49	CVE-2022-1664	22	Dir. Trav.	2022-05-26	2022-12-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
50	CVE-2022-1652	416	DoS Exec Code	2022-06-02	2022-10-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.

Total number of vulnerabilities : 1228 Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25