Debian: >> Debian Linux >> 10.0 Security Vulnerabilities
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVSS Score
6.1
EPSS Score
0.011
Published
2019-12-10
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).
CVSS Score
5.3
EPSS Score
0.143
Published
2019-12-06
OpenStack nova base images permissions are world readable
CVSS Score
5.5
EPSS Score
0.004
Published
2019-12-05
An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0
CVSS Score
9.8
EPSS Score
0.02
Published
2019-12-04
An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.
CVSS Score
8.8
EPSS Score
0.018
Published
2019-12-03
A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
CVSS Score
5.3
EPSS Score
0.004
Published
2019-12-03
shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees
CVSS Score
4.7
EPSS Score
0.003
Published
2019-12-03
webauth before 4.6.1 has authentication credential disclosure
CVSS Score
7.5
EPSS Score
0.016
Published
2019-12-03
FreeBSD: Input Validation Flaw allows local users to gain elevated privileges
CVSS Score
7.8
EPSS Score
0.004
Published
2019-12-02
relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.
CVSS Score
5.5
EPSS Score
0.005
Published
2019-11-30