Vulnerabilities > Debian > High

DATE CVE VULNERABILITY TITLE RISK
2018-10-22 CVE-2018-18557 Out-of-bounds Write vulnerability in multiple products
LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.
network
low complexity
libtiff debian canonical CWE-787
8.8
2018-10-20 CVE-2018-18541 Improper Input Validation vulnerability in multiple products
In Teeworlds before 0.6.5, connection packets could be forged.
network
low complexity
teeworlds debian CWE-20
7.5
2018-10-19 CVE-2018-18284 Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
local
low complexity
artifex debian canonical redhat pulsesecure
8.6
2018-10-18 CVE-2018-15756 Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource.
network
low complexity
vmware oracle debian
7.5
2018-10-18 CVE-2018-12386 Incorrect Type Conversion or Cast vulnerability in multiple products
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write.
network
low complexity
redhat debian canonical mozilla CWE-704
8.1
2018-10-18 CVE-2018-12385 Improper Input Validation vulnerability in multiple products
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory.
local
high complexity
redhat debian canonical mozilla CWE-20
7.0
2018-10-18 CVE-2018-12379 Out-of-bounds Write vulnerability in multiple products
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash.
local
low complexity
redhat debian mozilla CWE-787
7.8
2018-10-18 CVE-2018-12364 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site.
network
low complexity
redhat debian canonical mozilla CWE-352
8.8
2018-10-18 CVE-2018-12363 Use After Free vulnerability in multiple products
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it.
network
low complexity
redhat debian canonical mozilla CWE-416
8.8
2018-10-18 CVE-2018-12362 Integer Overflow or Wraparound vulnerability in multiple products
An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash.
network
low complexity
redhat debian canonical mozilla CWE-190
8.8