Vulnerabilities > Debian > High

DATE CVE VULNERABILITY TITLE RISK
2017-05-14 CVE-2017-7487 Use After Free vulnerability in multiple products
The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.
local
low complexity
linux debian CWE-416
7.8
2017-05-10 CVE-2017-8890 Double Free vulnerability in multiple products
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
local
low complexity
linux debian CWE-415
7.8
2017-05-08 CVE-2017-8844 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.
local
low complexity
long-range-zip-project debian CWE-119
7.8
2017-05-02 CVE-2017-7483 Out-of-bounds Read vulnerability in multiple products
Rxvt 2.7.10 is vulnerable to a denial of service attack by passing the value -2^31 inside a terminal escape code, which results in a non-invertible integer that eventually leads to a segfault due to an out of bounds read.
network
low complexity
rxvt-project debian CWE-125
7.5
2017-04-27 CVE-2017-8291 Type Confusion vulnerability in multiple products
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
local
low complexity
artifex debian redhat CWE-843
7.8
2017-04-26 CVE-2017-8283 Path Traversal vulnerability in Debian Dpkg
dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.
network
low complexity
debian CWE-22
7.5
2017-04-24 CVE-2017-5043 Use After Free vulnerability in multiple products
Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.
network
low complexity
google redhat debian CWE-416
8.8
2017-04-24 CVE-2017-5039 Use After Free vulnerability in multiple products
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
local
low complexity
google debian redhat CWE-416
7.8
2017-04-24 CVE-2017-5037 Integer Overflow or Wraparound vulnerability in multiple products
An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
local
low complexity
google debian redhat CWE-190
7.8
2017-04-24 CVE-2017-5036 Use After Free vulnerability in multiple products
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.
local
low complexity
google debian redhat CWE-416
7.8