Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Debian_linux
(Debian)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2021-07-22 | CVE-2021-35942 | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations. | Debian_linux, Glibc, Active_iq_unified_manager, E\-Series_santricity_os_controller, Hci_management_node, Ontap_select_deploy_administration_utility, Solidfire | 9.1 | ||
| 2021-07-30 | CVE-2021-32610 | In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. | Debian_linux, Fedora, Archive_tar | 7.1 | ||
| 2021-08-02 | CVE-2021-35477 | In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value. | Debian_linux, Fedora, Linux_kernel | 5.5 | ||
| 2021-08-02 | CVE-2021-34556 | In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack. | Debian_linux, Fedora, Linux_kernel | 5.5 | ||
| 2021-08-04 | CVE-2021-38114 | libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. | Debian_linux, Ffmpeg | 5.5 | ||
| 2021-08-07 | CVE-2021-38165 | Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. | Debian_linux, Fedora, Lynx | 5.3 | ||
| 2021-08-07 | CVE-2021-38166 | In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability. | Debian_linux, Fedora, Linux_kernel | 7.8 | ||
| 2021-08-07 | CVE-2021-38173 | Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys. | Debian_linux, Btrbk, Fedora | 9.8 | ||
| 2021-08-08 | CVE-2021-36221 | Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. | Debian_linux, Fedora, Go, Timesten_in\-Memory_database, Scalance_lpe9403_firmware | 5.9 | ||
| 2021-08-13 | CVE-2021-37695 | ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2. | Ckeditor, Debian_linux, Fedora, Application_express, Banking_party_management, Commerce_guided_search, Commerce_merchandising, Documaker, Financial_services_analytical_applications_infrastructure, Financial_services_model_management_and_governance, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools | 5.4 |