Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Debian_linux
(Debian)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2019-09-27 | CVE-2019-9371 | In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254 | Ubuntu_linux, Debian_linux, Fedora, Android, Leap | 6.5 | ||
| 2019-09-27 | CVE-2019-9433 | In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354 | Ubuntu_linux, Debian_linux, Fedora, Android, Leap | 6.5 | ||
| 2019-09-28 | CVE-2019-16935 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. | Ubuntu_linux, Debian_linux, Python | 6.1 | ||
| 2019-09-30 | CVE-2019-16276 | Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. | Debian_linux, Fedora, Go, Cloud_insights_telegraf_agent, Leap, Developer_tools, Enterprise_linux, Enterprise_linux_eus, Openshift_container_platform | 7.5 | ||
| 2019-10-01 | CVE-2019-17052 | ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768. | Ubuntu_linux, Debian_linux, Fedora, Linux_kernel | 3.3 | ||
| 2019-10-01 | CVE-2019-17055 | base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21. | Ubuntu_linux, Debian_linux, Fedora, Linux_kernel, Leap, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_workstation | 3.3 | ||
| 2019-10-01 | CVE-2019-16942 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and... | Debian_linux, Jackson\-Databind, Fedora, Active_iq_unified_manager, Oncommand_api_services, Oncommand_workflow_automation, Service_level_manager, Steelstore_cloud_integrated_storage, Banking_platform, Communications_billing_and_revenue_management, Communications_calendar_server, Communications_cloud_native_core_network_slice_selection_function, Communications_evolved_communications_application_server, Database_server, Global_lifecycle_management_nextgen_oui_framework, Goldengate_application_adapters, Jd_edwards_enterpriseone_orchestrator, Jd_edwards_enterpriseone_tools, Primavera_gateway, Primavera_unifier, Retail_merchandising_system, Retail_sales_audit, Siebel_engineering_\-_installer_\&_deployment, Siebel_ui_framework, Webcenter_portal, Webcenter_sites, Weblogic_server, Jboss_enterprise_application_platform | 9.8 | ||
| 2019-10-01 | CVE-2019-16943 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling. | Debian_linux, Jackson\-Databind, Fedora, Active_iq_unified_manager, Oncommand_api_services, Oncommand_workflow_automation, Service_level_manager, Steelstore_cloud_integrated_storage, Banking_platform, Communications_billing_and_revenue_management, Communications_calendar_server, Communications_cloud_native_core_network_slice_selection_function, Communications_evolved_communications_application_server, Global_lifecycle_management_nextgen_oui_framework, Goldengate_application_adapters, Jd_edwards_enterpriseone_orchestrator, Jd_edwards_enterpriseone_tools, Primavera_gateway, Retail_merchandising_system, Retail_sales_audit, Siebel_engineering_\-_installer_\&_deployment, Trace_file_analyzer, Webcenter_portal, Webcenter_sites, Weblogic_server, Jboss_enterprise_application_platform | 9.8 | ||
| 2019-10-03 | CVE-2018-14461 | The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print(). | Mac_os_x, Debian_linux, Fedora, Leap, Enterprise_linux, Tcpdump | 7.5 | ||
| 2019-10-03 | CVE-2018-14462 | The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print(). | Mac_os_x, Debian_linux, Traffix_signaling_delivery_controller, Fedora, Leap, Enterprise_linux, Tcpdump | 7.5 |