Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Debian_linux
(Debian)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2019-10-03 | CVE-2019-15166 | lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks. | Mac_os_x, Ubuntu_linux, Debian_linux, Fedora, Cloud_backup, Hci_management_node, Solidfire, Leap, Enterprise_linux, Tcpdump | 7.5 | ||
| 2019-10-03 | CVE-2019-15165 | sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. | Ipados, Iphone_os, Mac_os_x, Tvos, Watchos, Ubuntu_linux, Debian_linux, Fedora, Leap, Communications_operations_monitor, Libpcap | 5.3 | ||
| 2019-10-07 | CVE-2019-17267 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. | Debian_linux, Jackson\-Databind, Active_iq_unified_manager, Oncommand_api_services, Oncommand_workflow_automation, Service_level_manager, Steelstore_cloud_integrated_storage, Customer_management_and_segmentation_foundation, Goldengate_application_adapters, Retail_customer_management_and_segmentation_foundation, Weblogic_server, Jboss_enterprise_application_platform | 9.8 | ||
| 2019-10-07 | CVE-2019-17041 | An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid,... | Debian_linux, Fedora, Leap, Rsyslog | 9.8 | ||
| 2019-10-07 | CVE-2019-17042 | An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the... | Debian_linux, Fedora, Leap, Rsyslog | 9.8 | ||
| 2019-10-10 | CVE-2019-17455 | Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request. | Ubuntu_linux, Debian_linux, Fedora, Libntlm, Backports_sle, Leap | 9.8 | ||
| 2019-10-12 | CVE-2019-17531 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. | Debian_linux, Jackson\-Databind, Oncommand_workflow_automation, Steelstore_cloud_integrated_storage, Banking_platform, Communications_billing_and_revenue_management, Communications_calendar_server, Communications_cloud_native_core_network_slice_selection_function, Communications_evolved_communications_application_server, Global_lifecycle_management_nextgen_oui_framework, Goldengate_application_adapters, Jd_edwards_enterpriseone_orchestrator, Jd_edwards_enterpriseone_tools, Primavera_gateway, Retail_merchandising_system, Retail_sales_audit, Siebel_engineering_\-_installer_\&_deployment, Trace_file_analyzer, Webcenter_portal, Webcenter_sites, Weblogic_server, Jboss_enterprise_application_platform | 9.8 | ||
| 2019-10-14 | CVE-2019-17540 | ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c. | Debian_linux, Imagemagick | 8.8 | ||
| 2019-10-14 | CVE-2019-17545 | GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded. | Debian_linux, Fedora, Backports_sle, Leap, Spatial_and_graph, Gdal | 9.8 | ||
| 2019-10-16 | CVE-2019-11281 | Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information. | Debian_linux, Fedora, Rabbitmq, Openstack, Openstack_for_ibm_power | 4.8 |