debian Vulnerabilities and Affected Products

Products

debian_linux34 vulnerabilities
dpkg3 vulnerabilities
icoutils3 vulnerabilities
debusine2 vulnerabilities
netqmail2 vulnerabilities
apt1 vulnerability
as_dcp_lib1 vulnerability
BIND91 vulnerability
Debian based GNU GRUB1 vulnerability
Debian cpio1 vulnerability
Debian Edu1 vulnerability
debian-edu-config1 vulnerability
devscripts1 vulnerability
diffoscope1 vulnerability
duck1 vulnerability
FreedomBox1 vulnerability
pdns1 vulnerability
redis1 vulnerability
schroot1 vulnerability
tin1 vulnerability
trixie1 vulnerability
x11-common1 vulnerability
zulucrypt1 vulnerability

debian vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-28219	Pillow buffer overflow vulnerability In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. CWE-120 CWE-676 CWE-680Apr 3, 2024	CVSS-v4.0	EPSS0.997%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1553HIGH	Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. CWE-119Feb 20, 2024	CVSS8.1v3.1	EPSS0.859%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-7101HIGH	Arbitrary Code Execution (ACE) Vulnerability Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. CWE-94 CWE-95Dec 24, 2023	CVSS7.8v3.1	EPSS16.8%	PoCs1	SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-43770MEDIUM	Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. CWE-79Sep 22, 2023	CVSS6.1v3.1	EPSS58.5%	PoCs3	SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-41993HIGH	Apple Multiple Products WebKit Code Execution Vulnerability The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7. CWE-754Sep 21, 2023	CVSS8.8v3.1	EPSS29.2%	PoCs3	SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-4762HIGH	Google Chromium V8 Type Confusion Vulnerability Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) CWE-843Sep 5, 2023	CVSS8.8v3.1	EPSS38%	PoCs2	SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-36053	Django has regular expression denial of service vulnerability in EmailValidator/URLValidator In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs. CWE-1333Jul 3, 2023	CVSS-v4.0	EPSS2.98%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-32067HIGH	0-byte UDP payload DoS in c-ares c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1. CWE-400May 25, 2023	CVSS7.5v3.1	EPSS1.58%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-21930HIGH	Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauth… Apr 18, 2023	CVSS7.4v3.1	EPSS1.3%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-1989HIGH	A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. CWE-416Apr 11, 2023	CVSS7.1v3.1	EPSS0.387%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-10650HIGH	jackson-databind vulnerable to unsafe deserialization A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. CWE-502Dec 26, 2022	CVSS8.1v3.1	EPSS3.33%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-21797	Arbitrary Code Execution The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. CWE-94Sep 26, 2022	CVSS-v4.0	EPSS2.09%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-2097MEDIUM	AES OCB fails to encrypt some bytes AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed… CWE-311 CWE-326 CWE-327Jul 5, 2022	CVSS5.3v3.1	EPSS4.43%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-4043MEDIUM	NULL Pointer Dereference in gpac/gpac NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0. CWE-476Feb 4, 2022	CVSS5.5v3.1	EPSS4.61%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-35564MEDIUM	Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delet… Oct 20, 2021	CVSS5.3v3.1	EPSS5.63%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-41133HIGH	Sandbox bypass via recent VFS-manipulating syscalls Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's den… CWE-20Oct 8, 2021	CVSS8.8v3.1	EPSS0.436%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-36179HIGH	Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. CWE-502Jan 6, 2021	CVSS8.8v3.1	EPSS20.9%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-36180HIGH	Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. CWE-502Jan 6, 2021	CVSS8.8v3.1	EPSS5.04%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-36182HIGH	Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. CWE-502Jan 6, 2021	CVSS8.8v3.1	EPSS5.02%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-36184HIGH	Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. CWE-502Jan 6, 2021	CVSS8.8v3.1	EPSS10.4%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-36181HIGH	Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. CWE-502Jan 6, 2021	CVSS8.8v3.1	EPSS5.02%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-11111HIGH	jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms). CWE-502Mar 31, 2020	CVSS8.8v3.1	EPSS3.49%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-11112HIGH	jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy). CWE-502Mar 31, 2020	CVSS8.8v3.1	EPSS3.58%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-11113HIGH	jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). CWE-502Mar 31, 2020	CVSS8.8v3.1	EPSS6.28%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2020-10968HIGH	jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy). CWE-502Mar 26, 2020	CVSS8.8v3.1	EPSS3.63%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX