Debian: >> Debian Linux Security Vulnerabilities
mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.
CVSS Score
5.5
EPSS Score
0.003
Published
2022-04-03
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
CVSS Score
7.8
EPSS Score
0.004
Published
2022-04-03
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
CVSS Score
5.5
EPSS Score
0.006
Published
2022-04-02
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.
CVSS Score
9.1
EPSS Score
0.022
Published
2022-03-30
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.
CVSS Score
7.5
EPSS Score
0.021
Published
2022-03-30
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
CVSS Score
7.8
EPSS Score
0.015
Published
2022-03-30
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
CVSS Score
6.1
EPSS Score
0.012
Published
2022-03-30
A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.
CVSS Score
5.5
EPSS Score
0.011
Published
2022-03-29
lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted Irz file.
CVSS Score
5.5
EPSS Score
0.009
Published
2022-03-28
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
CVSS Score
4.4
EPSS Score
0.004
Published
2022-03-25