Debian: >> Debian Linux >> 10.0 Security Vulnerabilities
The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation.
CVSS Score
6.7
EPSS Score
0.004
Published
2019-11-15
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
CVSS Score
7.5
EPSS Score
0.023
Published
2019-11-15
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
CVSS Score
5.9
EPSS Score
0.015
Published
2019-11-15
ClamAV before 0.97.7 has WWPack corrupt heap memory
CVSS Score
9.8
EPSS Score
0.029
Published
2019-11-15
ClamAV before 0.97.7 has buffer overflow in the libclamav component
CVSS Score
9.8
EPSS Score
0.031
Published
2019-11-15
ClamAV before 0.97.7: dbg_printhex possible information leak
CVSS Score
7.5
EPSS Score
0.019
Published
2019-11-15
Chrony before 1.29.1 has traffic amplification in cmdmon protocol
CVSS Score
7.5
EPSS Score
0.042
Published
2019-11-15
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
CVSS Score
5.3
EPSS Score
0.025
Published
2019-11-14
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVSS Score
6.5
EPSS Score
0.031
Published
2019-11-14
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.
CVSS Score
9.8
EPSS Score
0.205
Published
2019-11-14