Debian: >> Debian Linux >> 10.0 Security Vulnerabilities
In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers.
CVSS Score
5.5
EPSS Score
0.008
Published
2019-10-30
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar backports for the fix for 2017-3137 may also be affected.
CVSS Score
7.5
EPSS Score
0.014
Published
2019-10-30
ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.
CVSS Score
8.2
EPSS Score
0.016
Published
2019-10-29
gpw generates shorter passwords than required
CVSS Score
7.5
EPSS Score
0.015
Published
2019-10-29
asterisk allows calls on prohibited networks
CVSS Score
7.5
EPSS Score
0.012
Published
2019-10-29
paxtest handles temporary files insecurely
CVSS Score
5.5
EPSS Score
0.004
Published
2019-10-29
CVE-2019-11043
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Known exploited
CVSS Score
8.7
EPSS Score
0.998
Published
2019-10-28
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
CVSS Score
7.5
EPSS Score
0.047
Published
2019-10-24
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.
CVSS Score
4.3
EPSS Score
0.021
Published
2019-10-23
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
CVSS Score
5.4
EPSS Score
0.016
Published
2019-10-22