Vulnerabilities > Debian > High

DATE CVE VULNERABILITY TITLE RISK
2016-02-08 CVE-2016-0728 The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.
local
low complexity
google hp linux debian canonical
7.8
2016-01-26 CVE-2016-1233 Permissions, Privileges, and Access Controls vulnerability in Debian Fuse 2.9.314
An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device, which allows local users to gain privileges via a character device in /dev, related to an ioctl.
local
low complexity
debian CWE-264
7.2
2016-01-21 CVE-2016-0546 Local Security vulnerability in Oracle MySQL
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client.
local
low complexity
canonical mariadb redhat oracle opensuse debian
7.2
2016-01-19 CVE-2015-6831 Use After Free vulnerability in multiple products
Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.
network
low complexity
php debian CWE-416
7.3
2016-01-13 CVE-2015-8607 Improper Input Validation vulnerability in multiple products
The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
network
low complexity
canonical perl debian CWE-20
7.5
2016-01-12 CVE-2015-1779 Resource Exhaustion vulnerability in multiple products
The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.
8.6
2015-12-29 CVE-2015-8467 Improper Privilege Management vulnerability in multiple products
The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.
network
high complexity
samba debian canonical CWE-269
7.5
2015-12-29 CVE-2015-7540 Resource Management Errors vulnerability in multiple products
The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.
network
low complexity
samba canonical debian CWE-399
7.5
2015-12-29 CVE-2015-5252 Permissions, Privileges, and Access Controls vulnerability in multiple products
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
network
low complexity
samba canonical debian CWE-264
7.2
2015-12-17 CVE-2015-8327 Arbitrary Command Execution vulnerability in cups-filters
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.
network
low complexity
redhat linuxfoundation canonical debian
7.5