Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Debian_linux
(Debian)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-06-04 | CVE-2020-13777 | GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. | Ubuntu_linux, Debian_linux, Fedora, Gnutls | 7.4 | ||
| 2020-06-04 | CVE-2020-13692 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. | Debian_linux, Fedora, Steelstore_cloud_integrated_storage, Postgresql_jdbc_driver, Quarkus | 7.7 | ||
| 2020-06-04 | CVE-2020-13765 | rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. | Ubuntu_linux, Debian_linux, Qemu | 5.6 | ||
| 2020-06-06 | CVE-2020-13871 | SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. | Debian_linux, Fedora, Cloud_backup, Ontap_select_deploy_administration_utility, Communications_messaging_server, Communications_network_charging_and_control, Enterprise_manager_ops_center, Hyperion_infrastructure_technology, Mysql_workbench, Zfs_storage_appliance_kit, Sinec_infrastructure_network_services, Sqlite | 7.5 | ||
| 2020-06-07 | CVE-2020-13904 | FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c. | Ubuntu_linux, Debian_linux, Ffmpeg | 5.5 | ||
| 2020-06-08 | CVE-2020-13625 | PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message. | Ubuntu_linux, Debian_linux, Fedora, Phpmailer | 7.5 | ||
| 2020-06-08 | CVE-2020-13696 | An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to test for the existence of arbitrary files and to trigger an open on arbitrary files with mode O_RDWR. To achieve this, relative path components need to be added to the device path, as demonstrated... | Ubuntu_linux, Debian_linux, Fedora, Xawtv, Backports_sle, Leap | 4.4 | ||
| 2020-06-08 | CVE-2020-13428 | A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file. | Debian_linux, Vlc_media_player | 7.8 | ||
| 2020-06-09 | CVE-2020-13964 | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object. | Debian_linux, Fedora, Webmail | 6.1 | ||
| 2020-06-11 | CVE-2020-0198 | In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941 | Ubuntu_linux, Debian_linux, Fedora, Android, Libexif | 7.5 |