Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Debian_linux
(Debian)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-02-05 | CVE-2020-8631 | cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function. | Cloud\-Init, Debian_linux, Leap | 5.5 | ||
| 2020-02-05 | CVE-2020-8632 | In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords. | Cloud\-Init, Debian_linux, Leap | 5.5 | ||
| 2020-02-06 | CVE-2020-8647 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. | Debian_linux, Linux_kernel, Leap | 6.1 | ||
| 2020-02-06 | CVE-2020-8648 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. | Brocade_fabric_operating_system_firmware, Ubuntu_linux, Debian_linux, Linux_kernel, Active_iq_unified_manager, Cloud_backup, Hci_baseboard_management_controller, Solidfire_baseboard_management_controller, Leap | 7.1 | ||
| 2020-02-06 | CVE-2020-8649 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. | Debian_linux, Linux_kernel, Leap | 5.9 | ||
| 2020-02-06 | CVE-2020-8608 | In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. | Debian_linux, Libslirp, Leap | 5.6 | ||
| 2020-02-10 | CVE-2020-8840 | FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. | Debian_linux, Jackson\-Databind, Oceanstor_9000_firmware, Oncommand_api_services, Oncommand_workflow_automation, Service_level_manager, Steelstore_cloud_integrated_storage, Global_lifecycle_management_opatch | 9.8 | ||
| 2020-02-10 | CVE-2020-7059 | When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash. | Debian_linux, Leap, Communications_diameter_signaling_router, Php, Tenable\.sc | 9.1 | ||
| 2020-02-10 | CVE-2020-7060 | When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash. | Debian_linux, Leap, Communications_diameter_signaling_router, Php, Tenable\.sc | 9.1 | ||
| 2020-02-11 | CVE-2020-5529 | HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application. | Camel, Ubuntu_linux, Debian_linux, Htmlunit | 8.1 |