Vulnerabilities > Debian > Debian Linux
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-12-09 | CVE-2013-7020 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data. | 6.8 |
| 2013-12-07 | CVE-2013-6410 | Permissions, Privileges, and Access Controls vulnerability in multiple products nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file. | 7.5 |
| 2013-11-20 | CVE-2013-4560 | USE After Free vulnerability in multiple products Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures. | 5.0 |
| 2013-11-20 | CVE-2013-4559 | Permissions, Privileges, and Access Controls vulnerability in multiple products lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached. | 7.6 |
| 2013-11-18 | CVE-2013-6632 | Numeric Errors vulnerability in Google Chrome Integer overflow in Google Chrome before 31.0.1650.57 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013. | 9.3 |
| 2013-11-18 | CVE-2013-1418 | Null Pointer Dereference vulnerability in multiple products The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request. | 4.3 |
| 2013-11-13 | CVE-2013-6621 | Resource Management Errors vulnerability in multiple products Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the x-webkit-speech attribute in a text INPUT element. | 7.5 |
| 2013-11-13 | CVE-2013-4475 | Permissions, Privileges, and Access Controls vulnerability in multiple products Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS). | 4.0 |
| 2013-11-08 | CVE-2013-4508 | Inadequate Encryption Strength vulnerability in multiple products lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network. | 4.3 |
| 2013-11-05 | CVE-2013-4135 | Cryptographic Issues vulnerability in multiple products The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network. | 4.3 |