Vulnerabilities > Debian > High

DATE CVE VULNERABILITY TITLE RISK
2017-04-24 CVE-2017-5035 Race Condition vulnerability in multiple products
Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.
network
high complexity
google debian redhat CWE-362
8.1
2017-04-24 CVE-2017-5030 Out-of-bounds Read vulnerability in multiple products
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
network
low complexity
google debian redhat CWE-125
8.8
2017-04-24 CVE-2017-5029 Out-of-bounds Write vulnerability in multiple products
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
network
low complexity
google xmlsoft debian redhat CWE-787
8.8
2017-04-24 CVE-2017-8105 Out-of-bounds Write vulnerability in multiple products
FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.
network
low complexity
freetype debian CWE-787
7.5
2017-04-23 CVE-2017-8073 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin.
network
low complexity
weechat debian CWE-119
7.5
2017-04-23 CVE-2017-8064 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
local
low complexity
linux debian CWE-119
7.8
2017-04-18 CVE-2017-7645 Improper Input Validation vulnerability in multiple products
The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c.
network
low complexity
linux debian canonical CWE-20
7.5
2017-04-17 CVE-2017-7889 Incorrect Permission Assignment for Critical Resource vulnerability in multiple products
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
local
low complexity
linux debian canonical CWE-732
7.8
2017-04-14 CVE-2017-7865 Out-of-bounds Write vulnerability in multiple products
FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.
network
low complexity
ffmpeg debian CWE-787
7.5
2017-04-14 CVE-2017-7863 Out-of-bounds Write vulnerability in multiple products
FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.
network
low complexity
ffmpeg debian CWE-787
7.5