Skip to content

Product

debian/r-base vulnerabilities

7 published CVES affecting debian/r-base, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
7
Critical
1
High
2
Medium
1
Low
0
Unscored
3
CISA KEV
0

Latest debian/r-base CVEs

Newest publication first

  1. CVE-2024-27322 Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serial...

    Published
    HighCVSS 8.8 EPSS 23.4%

    Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s syst...

  2. CVE-2020-27637 The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD....

    Published
    CriticalCVSS 9.8 EPSS 2.3%

    The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Upd...

  5. CVE-2016-8714 An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script can cause a buffer overflow resulting in...

    Published
    HighCVSS 8.8 EPSS 2.4%

    An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script can cause a buffer overflow resulting in a memory corruption. An attacker can send a malicious R script to trigger this...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.