Vulnerabilities > Debian > Debian Linux > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-11-23 | CVE-2017-16927 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream. | 8.4 |
| 2017-11-22 | CVE-2017-15098 | Information Exposure vulnerability in multiple products Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory. | 8.1 |
| 2017-11-21 | CVE-2017-16664 | Code Injection vulnerability in multiple products Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. | 8.8 |
| 2017-11-20 | CVE-2017-2919 | Out-of-bounds Write vulnerability in multiple products An exploitable stack based buffer overflow vulnerability exists in the xls_getfcell function of libxls 1.3.4. | 7.8 |
| 2017-11-20 | CVE-2017-2896 | Out-of-bounds Write vulnerability in multiple products An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. | 7.8 |
| 2017-11-20 | CVE-2017-12608 | Out-of-bounds Write vulnerability in multiple products A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. | 7.8 |
| 2017-11-20 | CVE-2017-12607 | Out-of-bounds Write vulnerability in multiple products A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. | 7.8 |
| 2017-11-20 | CVE-2017-16899 | Improper Validation of Array Index vulnerability in multiple products An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c. | 7.1 |
| 2017-11-20 | CVE-2017-16544 | Code Injection vulnerability in multiple products In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. | 8.8 |
| 2017-11-17 | CVE-2017-1000229 | Integer Overflow or Wraparound vulnerability in multiple products Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service. | 7.8 |