Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Debian_linux
(Debian)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2017-06-02 | CVE-2017-9404 | In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file. | Ubuntu_linux, Debian_linux, Libtiff | 6.5 | ||
| 2017-06-02 | CVE-2017-9403 | In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file. | Ubuntu_linux, Debian_linux, Libtiff | 6.5 | ||
| 2017-06-12 | CVE-2017-9324 | In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end. | Debian_linux, Otrs | 8.8 | ||
| 2017-05-19 | CVE-2017-9079 | Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed. | Debian_linux, Dropbear_ssh | 4.7 | ||
| 2017-05-18 | CVE-2017-9066 | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. | Debian_linux, Wordpress | 8.6 | ||
| 2017-05-18 | CVE-2017-9065 | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. | Debian_linux, Wordpress | 7.5 | ||
| 2017-05-18 | CVE-2017-9064 | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials. | Debian_linux, Wordpress | 8.8 | ||
| 2017-05-18 | CVE-2017-9063 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. | Debian_linux, Wordpress | 6.1 | ||
| 2017-05-18 | CVE-2017-9062 | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. | Debian_linux, Wordpress | 8.6 | ||
| 2017-05-18 | CVE-2017-9061 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. | Debian_linux, Wordpress | 6.1 |