CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Debian » Debian Linux » 10 : Security Vulnerabilities

Cpe Name:cpe:/o:debian:debian_linux:10
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-16928 120 Exec Code Overflow 2019-09-27 2019-10-02
7.5
None Remote Low Not required Partial Partial Partial
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
2 CVE-2019-15941 863 Bypass 2019-09-25 2019-10-01
7.5
None Remote Low Not required Partial Partial Partial
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
3 CVE-2019-15892 20 DoS 2019-09-03 2019-09-25
7.8
None Remote Low Not required None None Complete
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
4 CVE-2019-15846 119 Exec Code Overflow 2019-09-06 2019-09-06
10.0
None Remote Low Not required Complete Complete Complete
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
5 CVE-2019-15239 416 2019-08-20 2019-09-24
7.2
None Local Low Not required Complete Complete Complete
In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139.
6 CVE-2019-14970 119 Overflow 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
7 CVE-2019-14778 416 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
8 CVE-2019-14777 416 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
9 CVE-2019-14776 125 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file.
10 CVE-2019-14535 369 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted WMV file.
11 CVE-2019-14534 476 DoS 2019-08-29 2019-09-06
4.3
None Remote Medium Not required None None Partial
In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack.
12 CVE-2019-14533 416 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
13 CVE-2019-14498 369 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted CAF file.
14 CVE-2019-14438 125 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file.
15 CVE-2019-14437 416 2019-08-29 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.
16 CVE-2019-12854 119 DoS Overflow 2019-08-15 2019-08-28
5.0
None Remote Low Not required None None Partial
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.
17 CVE-2019-10197 22 Dir. Trav. 2019-09-03 2019-09-16
6.4
None Remote Low Not required Partial Partial None
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.
18 CVE-2019-10081 119 Overflow 2019-08-15 2019-08-30
5.0
None Remote Low Not required None None Partial
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
Total number of vulnerabilities : 18   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.