Debian: >> Debian Linux Security Vulnerabilities
A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
CVSS Score
7.8
EPSS Score
0.019
Published
2022-01-25
In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.
CVSS Score
5.5
EPSS Score
0.009
Published
2022-01-25
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename.
CVSS Score
7.8
EPSS Score
0.011
Published
2022-01-25
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
CVSS Score
8.8
EPSS Score
0.066
Published
2022-01-25
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
CVSS Score
9.8
EPSS Score
0.051
Published
2022-01-24
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
CVSS Score
7.5
EPSS Score
0.052
Published
2022-01-21
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
CVSS Score
7.3
EPSS Score
0.019
Published
2022-01-21
USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.
CVSS Score
7.8
EPSS Score
0.005
Published
2022-01-21
Out-of-bounds Read in vim/vim prior to 8.2.
CVSS Score
5.5
EPSS Score
0.014
Published
2022-01-21
Heap-based Buffer Overflow in vim/vim prior to 8.2.
CVSS Score
6.6
EPSS Score
0.02
Published
2022-01-21