Vulnerabilities > Debian > High

DATE CVE VULNERABILITY TITLE RISK
2017-03-23 CVE-2016-9775 Permissions, Privileges, and Access Controls vulnerability in multiple products
The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack.
local
low complexity
debian canonical apache CWE-264
7.2
2017-03-23 CVE-2016-9774 Link Following vulnerability in multiple products
The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.
local
low complexity
debian canonical apache CWE-59
7.2
2017-03-17 CVE-2017-6960 Integer Overflow or Wraparound vulnerability in multiple products
An issue was discovered in apng2gif 1.7.
network
low complexity
apng2gif-project debian canonical CWE-190
7.5
2017-03-16 CVE-2017-5617 Server-Side Request Forgery (SSRF) vulnerability in multiple products
The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
network
low complexity
debian kitfox CWE-918
7.4
2017-03-15 CVE-2017-5522 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
network
low complexity
debian osgeo CWE-119
7.5
2017-03-15 CVE-2016-10196 Out-of-bounds Write vulnerability in multiple products
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
network
low complexity
debian libevent-project mozilla CWE-787
7.5
2017-03-15 CVE-2016-10195 Out-of-bounds Read vulnerability in multiple products
The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.
network
low complexity
libevent-project debian CWE-125
7.5
2017-03-15 CVE-2017-6060 Out-of-bounds Write vulnerability in multiple products
Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc.
local
low complexity
artifex debian CWE-787
7.8
2017-03-10 CVE-2017-6802 Out-of-bounds Read vulnerability in multiple products
An issue was discovered in ytnef before 1.9.2.
network
low complexity
ytnef-project debian CWE-125
7.5
2017-03-10 CVE-2017-6801 Out-of-bounds Read vulnerability in multiple products
An issue was discovered in ytnef before 1.9.2.
network
low complexity
ytnef-project debian CWE-125
7.5