Vulnerabilities > Debian > High

DATE CVE VULNERABILITY TITLE RISK
2017-04-29 CVE-2017-7957 Improper Input Validation vulnerability in multiple products
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
network
low complexity
xstream-project debian CWE-20
7.5
2017-04-27 CVE-2017-8291 Type Confusion vulnerability in multiple products
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
local
low complexity
artifex debian redhat CWE-843
7.8
2017-04-24 CVE-2017-5043 Use After Free vulnerability in multiple products
Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.
network
low complexity
google redhat debian CWE-416
8.8
2017-04-24 CVE-2017-5039 Use After Free vulnerability in multiple products
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
local
low complexity
google debian redhat CWE-416
7.8
2017-04-24 CVE-2017-5037 Integer Overflow or Wraparound vulnerability in multiple products
An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
local
low complexity
google debian redhat CWE-190
7.8
2017-04-24 CVE-2017-5036 Use After Free vulnerability in multiple products
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.
local
low complexity
google debian redhat CWE-416
7.8
2017-04-24 CVE-2017-5035 Race Condition vulnerability in multiple products
Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.
network
high complexity
google debian redhat CWE-362
8.1
2017-04-24 CVE-2017-5030 Out-of-bounds Read vulnerability in multiple products
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
network
low complexity
google debian redhat CWE-125
8.8
2017-04-24 CVE-2017-5029 Out-of-bounds Write vulnerability in multiple products
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
network
low complexity
google xmlsoft debian redhat CWE-787
8.8
2017-04-24 CVE-2017-3329 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Thread Pooling).
network
low complexity
oracle debian
7.5