1,460 results · Clear filters · Feed
-
Critical max 10.0USN-5253-1 4 CVEs
ruby-rack vulnerabilities
It was discovered that Rack insecurely handled session ids. An unauthenticated remote attacker could possibly use this issue to perform a timing attack and hijack sessions. (CVE-2019-16782) It was discovered that Rack was incorrectly handling cookies during p…
first Dec 13, 2022 -
Critical max 9.8USN-5227-2 5 CVEs
pillow vulnerabilities
USN-5227-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that Pillow incorrectly handled certain image files. If a user or automat…
first Jan 17, 2022 -
Critical max 9.8USN-5109-1 1 CVE
nginx vulnerability
It was discovered that nginx incorrectly handled files with certain modification dates. A remote attacker could possibly use this issue to cause a denial of service or other unspecified impact.
first Oct 18, 2021 -
Critical max 9.1USN-5102-2 2 CVEs
mercurial vulnerabilities
USN-5102-1 fixed vulnerabilities in Mercurial. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use …
first Mar 16, 2021 -
Critical max 9.0
apache2 vulnerabilities
USN-5090-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that the Apache HTTP Server incorrectly handled certain malformed request…
first Sep 27, 2021 -
Critical max 9.1USN-4991-1 8 CVEs
libxml2 vulnerabilities
Yunho Kim discovered that libxml2 incorrectly handled certain error conditions. A remote attacker could exploit this with a crafted XML file to cause a denial of service, or possibly cause libxml2 to expose sensitive information. This issue only affected Ubun…
first Jun 17, 2021 -
Critical max 9.8
openslp-dfsg vulnerability
It was discovered that OpenSLP did not properly validate URLs. A remote attacker could use this issue to cause OpenSLP to crash or possibly execute arbitrary code.
first Apr 19, 2021 -
Critical max 9.8
opensmtpd vulnerabilities
It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could possibly use this vulnerability to execute arbitrary commands as root. (CVE-2020-7247) It was discovered that OpenSMT…
first Mar 15, 2021 -
Critical max 9.8USN-4843-1 21 CVEs
phpmyadmin vulnerabilities
Javier Nieto and Andres Rojas discovered that phpMyAdmin incorrectly managed input in the form of passwords. An attacker could use this vulnerability to cause a denial-of-service (DoS). This issue only affected Ubuntu 14.04 ESM. (CVE-2014-9218) Emanuel Bronsh…
first Mar 16, 2021 -
Critical max 9.8USN-4769-1 8 CVEs
salt vulnerabilities
It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-3563)…
first Mar 15, 2021 -
Critical max 9.0USN-4767-1 9 CVEs
zabbix vulnerabilities
Fu Chuang discovered that Zabbix did not properly parse IPs. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2020-11800) It was discovered that Z…
first Jun 15, 2022 -
Critical max 9.8USN-4754-5 1 CVE
python2.7 vulnerability
USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a subsequent update removed the fix for CVE-2021-3177. This update reinstates the security fix for CVE-2021-3177 in Ubuntu 14.04 ESM. Original advisory details: It was discovered that Python…
first Feb 8, 2022 -
Critical max 9.8USN-4272-1 5 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911) It was discovered that Pillow incorrectly handled certain images. An attacker could poss…
first Feb 6, 2020 -
Critical max 9.8USN-6990-1 1 CVE
znc vulnerability
Johannes Kuhn (DasBrain) discovered that znc incorrectly handled user input under certain operations. An attacker could possibly use this issue to execute arbitrary code on a user's system if the user was tricked into joining a malicious server.
first Sep 4, 2024 -
Critical max 9.1USN-6559-1 2 CVEs
zookeeper vulnerabilities
It was discovered that ZooKeeper incorrectly handled authorization for the getACL() command. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-0201) Damie…
first Jan 16, 2024 -
Critical max 9.1USN-8476-1 4 CVEs
xrdp vulnerabilities
It was discovered that xrdp incorrectly handled bounds checking when processing user domain information during the connection sequence. An unauthenticated remote attacker could use this issue to cause xrdp to crash, resulting in a denial of service, or possib…
-
Critical max 9.9USN-8470-1 1 CVE
cpp-httplib vulnerability
It was discovered that cpp-httplib incorrectly percent-decoded HTTP request header values. A remote attacker could use this to inject crafted header content possibly leading to response splitting, log injection or proxy smuggling.
-
Critical max 9.3USN-7869-1 3 CVEs
raptor2 vulnerabilities
Hanno Böck discovered that Raptor incorrectly handled memory operations when processing certain input files. An attacker could possibly use this issue to cause Raptor to crash, resulting in a denial of service. (CVE-2020-25713) Pedro Ribeiro discovered that R…
first Nov 10, 2025 -
Critical max 10.0USN-7845-1 1 CVE
squid, squid3 vulnerability
Leonardo Giovannini discovered that Squid failed to redact HTTP Authentication credentials in a default configuration. An attacker could possibly use this issue to obtain sensitive information.
first Oct 28, 2025 -
Critical max 9.1USN-7839-2 1 CVE
google-guest-agent vulnerability
USN-7839-1 fixed vulnerabilities in Go Cryptography. This update provides the corresponding update in the Go Cryptography module included in Google Guest Agent. Original advisory details: Damien Tournoud, Patrick Dawkins, Vince Parker, and Jules Duvivier disc…
first Nov 3, 2025 -
Critical max 9.1USN-7839-1 1 CVE
golang-go.crypto vulnerability
Damien Tournoud, Patrick Dawkins, Vince Parker, and Jules Duvivier discovered that Go Cryptography incorrectly handled public keys during SSH operations. An attacker could possibly use this issue to bypass authorization mechanisms.
first Oct 23, 2025 -
Critical max 10.0USN-7826-2 2 CVEs
samba vulnerabilities
USN-7826-1 fixed vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: Andrew Walker discovered that Samba incorrectly initialized memo…
first Oct 20, 2025 -
Critical max 9.8USN-7823-1 9 CVEs
ffmpeg vulnerabilities
It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-35365) It was discovered t…
first Oct 15, 2025 -
Critical max 9.1USN-7694-1 4 CVEs
libxml2 vulnerabilities
Ahmed Lekssays discovered that libxml2 did not properly perform certain mathematical operations, leading to an integer overflow. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. …
first Aug 14, 2025 -
Critical max 9.1USN-7639-2 7 CVEs
apache2 vulnerabilities
USN-7639-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and addressed a regression fix (LP: #2119395). CVE-2025-49630 and CVE-2025-53020 only affected Ubuntu 1…
first Aug 19, 2025 -
Critical max 9.8USN-7623-1 8 CVEs
ghostscript vulnerabilities
It was discovered that OpenJPEG, vendored in Ghostscript did not correctly handle large image files. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue onl…
first Jul 8, 2025 -
Critical max 9.9
roundcube vulnerability
It was discovered that Roundcube Webmail did not properly sanitize the _from parameter in a URL, leading to PHP Object Deserialization. A remote attacker could possibly use this issue to execute arbitrary code.
first Jun 19, 2025 -
Critical max 9.8USN-7582-1 4 CVEs
samba vulnerabilities
Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-3437) Greg Hudson discovered that Samb…
first Jun 19, 2025 -
Critical max 9.8USN-7569-1 4 CVEs
dojo vulnerabilities
It was discovered that Dojo did not correctly handle DataGrids. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-15494) It was discovered that Dojo was vulnerable to…
first Jun 16, 2025 -
Critical max 9.8USN-7502-1 1 CVE
php-horde-css-parser vulnerability
It was discovered that Horde Css Parser did not correctly handle parsing uncontrolled CSS data. An attacker could possibly use this issue to perform remote code execution. (CVE-2020-13756)
first May 7, 2025 -
Critical max 9.0USN-7490-1 9 CVEs
libsoup2.4 vulnerabilities
Tan Wei Chong discovered that libsoup incorrectly handled memory when parsing HTTP request headers. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service. (CVE-2025-32906) Alon Zahavi d…
first May 6, 2025 -
Critical max 10.0
erlang vulnerability
USN-7443-1 fixed a vulnerability in Erlang. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, and Jörg Schwenk discovered that Erlang OTP’s SSH …
first Jul 17, 2025 -
Critical max 9.3USN-7409-1 3 CVEs
ruby-saml vulnerabilities
It was discovered that ruby-saml did not correctly handle XML parsing. An attacker could possibly use this issue to perform a signature wrapping attack and bypass authentication. (CVE-2025-25291 and CVE-2025-25292) It was discovered that ruby-saml did not cor…
first Apr 2, 2025 -
Critical max 9.1USN-7394-1 2 CVEs
ruby-doorkeeper vulnerabilities
Jonathan Clem and Justin Bull discovered that Doorkeeper could allow arbitrary token revocation and replay attacks. An attacker could possibly use this issue to gain unauthorized access to a system. (CVE-2016-6582) It was discovered that Doorkeeper incorrectl…
first Mar 31, 2025 -
Critical max 9.8USN-7375-1 4 CVEs
org-mode vulnerabilities
It was discovered that Org Mode did not correctly handle filenames containing shell metacharacters. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-28617) I…
first Mar 27, 2025 -
Critical max 9.3USN-7353-1 1 CVE
plantuml vulnerability
Tobias S. Fink discovered that PlantUML was susceptible to cross-site scripting attacks (XSS) in instances where SVG images were rendered. An attacker could possibly use this issue to cause PlantUML to crash, resulting in a denial of service, or the execution…
first Mar 17, 2025 -
Critical max 9.0USN-7257-1 1 CVE
krb5 vulnerability
Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl discovered that Kerberos incorrectly authenticated certain responses. An attacker able to intercept communications between a RADIUS client and server could possibly us…
first Feb 5, 2025 -
Critical max 9.8USN-7225-1 9 CVEs
HTMLDOC vulnerabilities
It was discovered that HTMLDOC incorrectly handled memory in the image_set_mask, git_read_lzw, write_header and write_node functions, which could lead to a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute…
first Jan 22, 2025 -
Critical max 9.8USN-7208-1 1 CVE
bcel vulnerability
Felix Wilhelm discovered that Apache Commons BCEL APIs incorrectly handled parameters due to a memory issue. An attacker supplying malicious input could exploit this to generate and execute arbitrary bytecode.
first Jan 16, 2025 -
Critical max 9.8USN-7206-1 6 CVEs
Several security issues were fixed in rsync
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync did not properly handle checksum lengths. An attacker could use this issue to execute arbitrary code. (CVE-2024-12084) Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that …
first Jan 14, 2025