Vulnerabilities > Debian > Debian Linux > Medium

DATE CVE VULNERABILITY TITLE RISK
2016-04-21 CVE-2016-0640 Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect integrity and availability via vectors related to DML.
local
low complexity
oracle opensuse mariadb debian redhat ibm
6.1
2016-04-18 CVE-2016-1658 Improper Access Control vulnerability in multiple products
The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension.
network
low complexity
novell opensuse google debian CWE-284
4.3
2016-04-18 CVE-2016-1657 7PK - Security Features vulnerability in multiple products
The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL.
network
low complexity
debian novell opensuse google CWE-254
4.3
2016-04-18 CVE-2016-1654 Improper Input Validation vulnerability in multiple products
The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to cause a denial of service (invalid read operation) via unknown vectors.
network
low complexity
debian suse opensuse google canonical CWE-20
6.5
2016-04-18 CVE-2016-1652 Cross-site Scripting vulnerability in multiple products
Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
network
low complexity
debian suse opensuse google CWE-79
6.1
2016-04-13 CVE-2016-0787 Information Exposure vulnerability in multiple products
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
network
high complexity
fedoraproject opensuse libssh2 debian CWE-200
5.9
2016-04-13 CVE-2016-0739 Information Exposure vulnerability in multiple products
libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
5.9
2016-04-13 CVE-2015-8784 Out-of-bounds Write vulnerability in multiple products
The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif.
network
low complexity
libtiff debian CWE-787
6.5
2016-04-13 CVE-2015-8683 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
local
low complexity
libtiff debian CWE-119
5.5
2016-04-13 CVE-2015-1547 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.
network
low complexity
debian libtiff CWE-119
6.5