Opensuse Backports vulnerabilities
97 vulnerabilities
Known vulnerabilities in Opensuse Backports, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-19873canonicalubuntu_linux+6
EPSS score3.38%
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.CVE-2018-20177alpinerdesktop+6EPSS score7.93%
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution.CVE-2021-46142debianuriparser+8EPSS score1.09%
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.CVE-2021-46141debianuriparser+8EPSS score1.13%
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.CVE-2021-45082cobbler_projectcobbler+7EPSS score0.50%
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)CVE-2020-0561intelsoftware_guard_extensions_sdk+2EPSS score0.41%
Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2020-14983chocolate-doomchocolate_doom+11EPSS score2.69%
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.CVE-2020-5202apt-cacher-ng_projectapt-cacher-ng+5EPSS score0.47%
apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can.CVE-2020-10592debiantor+4EPSS score3.23%
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.CVE-2020-10938debiangraphicsmagick+5EPSS score4.66%
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.CVE-2020-15803debianzabbix+8EPSS score32.30%
Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.CVE-2020-6495debianchromium+5EPSS score1.07%
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.CVE-2020-6433debianchromium+6EPSS score1.66%
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.CVE-2020-6425debianchromium+5EPSS score1.18%
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension.CVE-2020-6437debianchromium+6EPSS score1.76%
Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted application.CVE-2020-6431debianchromium+6EPSS score1.59%
Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page.CVE-2020-6452debianchromium+5EPSS score1.86%
Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2020-6446debianchromium+6EPSS score1.66%
Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.CVE-2020-6435debianchromium+6EPSS score1.66%
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.CVE-2020-6432debianchromium+6EPSS score1.74%
Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.