Debian: >> Debian Linux Security Vulnerabilities
nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).
CVSS Score
7.5
EPSS Score
0.027
Published
2019-07-31
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
CVSS Score
4.6
EPSS Score
0.018
Published
2019-07-30
libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
CVSS Score
6.5
EPSS Score
0.009
Published
2019-07-30
In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU consumption. Attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVSS Score
6.5
EPSS Score
0.01
Published
2019-07-30
An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
CVSS Score
6.5
EPSS Score
0.012
Published
2019-07-30
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVSS Score
7.5
EPSS Score
0.108
Published
2019-07-30
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
CVSS Score
9.8
EPSS Score
0.188
Published
2019-07-29
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVSS Score
9.8
EPSS Score
0.081
Published
2019-07-29
In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service.
CVSS Score
6.5
EPSS Score
0.011
Published
2019-07-28
In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.
CVSS Score
6.5
EPSS Score
0.011
Published
2019-07-28