1,460 results · Clear filters · Feed
-
Critical max 9.8USN-7114-1 1 CVE
glib2.0 vulnerability
It was discovered that Glib incorrectly handled certain trailing characters. An attacker could possibly use this issue to cause a crash or other undefined behavior.
first Nov 18, 2024 -
Critical max 9.8USN-7190-1 1 CVE
tinyproxy vulnerability
It was discovered that Tinyproxy did not properly manage memory during the parsing of HTTP connection headers. An attacker could use this issue to cause a DoS or possibly execute arbitrary code.
first Jan 8, 2025 -
Critical max 9.8
phpunit vulnerability
It was discovered that PHPUnit incorrectly handled web requests if exposed to the internet. An attacker could possibly use this issue to achive remote code execution or obtain sensitive information.
first Dec 18, 2024 -
Critical max 10.0USN-7161-2 2 CVEs
Docker vulnerabilities
USN-7161-1 fixed CVE-2024-29018 in Ubuntu 24.04 LTS. This update fixes it for source package docker.io in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and source package docker.io-app for Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. USN-7161-1 fixed CVE-2024-41110 in Ubuntu…
first Feb 18, 2025 -
Critical max 9.8USN-7157-3 4 CVEs
php7.0 vulnerabilities
USN-7157-1 fixed vulnerabilities in PHP versions 7.4, 8.1, and 8.3. This update provides the corresponding updates for PHP version 7.0. Original advisory details: It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted…
first Jan 29, 2025 -
Critical max 9.8USN-7153-1 1 CVE
php7.0, php7.2 vulnerability
It was discovered that PHP incorrectly handled long string inputs in two database drivers. An attacker could possibly use this issue to write files in locations they would not normally have access to. (CVE-2024-11236)
first Dec 12, 2024 -
Critical max 9.8USN-7147-1 4 CVEs
shiro vulnerabilities
It was discovered that Apache Shiro incorrectly handled path traversal when used with other web frameworks or path rewriting. An attacker could possibly use this issue to obtain sensitive information or administrative privileges. This update provides the corr…
first Dec 10, 2024 -
Critical max 9.8
shiro vulnerability
It was discovered that Apache Shiro used a static cipher within the "Remember Me" feature inside authentication by default. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information.
first Dec 5, 2024 -
Critical max 9.1USN-7135-1 1 CVE
haproxy vulnerability
Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg, and Harvey Tuch discovered that HAProxy incorrectly handled empty header names. A remote attacker could possibly use this issue to manipulate headers and bypass certain authentication c…
first Dec 3, 2024 -
Critical max 9.8USN-7118-1 2 CVEs
zbar vulnerabilities
It was discovered that ZBar did not properly handle certain QR codes. If a user or automated system using ZBar were tricked into opening a specially crafted file, an attacker could possibly use this to obtain sensitive information. (CVE-2023-40889) It was dis…
first Nov 21, 2024 -
Critical max 9.8USN-7109-1 25 CVEs
golang-1.18 vulnerabilities
Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-41723) Marten Seemann discovered that Go did not properly manage memory under certain circumstanc…
first Nov 14, 2024 -
Critical max 9.8USN-7060-1 6 CVEs
edk2 vulnerabilities
It was discovered that EDK II did not check the buffer length in XHCI, which could lead to a stack overflow. A local attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2…
first Oct 10, 2024 -
Critical max 9.8USN-7027-1 9 CVEs
emacs, emacs24, emacs25 vulnerabilities
It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45939) Xi Lu discovered t…
first Sep 19, 2024 -
Critical max 9.1USN-7023-1 6 CVEs
git vulnerabilities
Maxime Escourbiac and Yassine Bengana discovered that Git incorrectly handled some gettext machinery. An attacker could possibly use this issue to allows the malicious placement of crafted messages. This issue was fixed in Ubuntu 16.04 LTS. (CVE-2023-25815) I…
first Sep 19, 2024 -
Critical max 9.8USN-7001-1 2 CVEs
libxmltok vulnerabilities
Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary co…
first Sep 12, 2024 -
Critical max 9.8
salt vulnerabilities
It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2020-16846) It was discovered that Salt incorrectly created certificates with weak file permissions. (CVE-202…
first Aug 8, 2024 -
Critical max 10.0
activemq vulnerabilities
Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain commands. A remote attacker could possibly use this issue to terminate the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-7559) Peter St…
first Jul 23, 2024 -
Critical max 9.8
apache2 vulnerabilities
USN-6885-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled c…
first Sep 18, 2024 -
Critical max 9.1USN-6852-2 1 CVE
wget vulnerability
USN-6852-1 fixed a vulnerability in Wget. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A r…
first Jun 27, 2024 -
Critical max 9.1USN-6753-1 1 CVE
cryptojs vulnerability
Thomas Neil James Shadwell discovered that CryptoJS was using an insecure cryptographic default configuration. A remote attacker could possibly use this issue to expose sensitive information.
first Apr 25, 2024 -
Critical max 9.8USN-6402-1 1 CVE
libtommath vulnerability
It was discovered that LibTomMath incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code and cause a denial of service (DoS).
first Oct 2, 2023 -
Critical max 9.8USN-6398-1 2 CVEs
minidlna vulnerabilities
It was discovered that ReadyMedia was vulnerable to DNS rebinding attacks. A remote attacker could possibly use this issue to trick the local DLNA server to leak information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ub…
first Sep 27, 2023 -
Critical max 9.2USN-7363-1 2 CVEs
pam-pkcs11 vulnerabilities
Marcus Rückert and Matthias Gerstner discovered that PAM-PKCS#11 did not properly handle certain return codes when authentication was not possible. An attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 24.04 LTS a…
first Mar 20, 2025 -
Critical max 9.4USN-6305-2 2 CVEs
php7.0, php7.2, php7.4 vulnerabilities
USN-6305-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled certain XML files. An attack…
first Feb 27, 2024 -
Critical max 9.8USN-6277-1 5 CVEs
php-dompdf vulnerabilities
It was discovered that Dompdf was not properly validating untrusted input when processing HTML content under certain circumstances. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected U…
first Aug 8, 2023 -
Critical max 10.0USN-6239-1 1 CVE
ecdsautils vulnerability
It was discovered that ECDSA Util did not properly verify certain signature values. An attacker could possibly use this issue to bypass signature verification.
first Jul 20, 2023 -
Critical max 9.1USN-6236-1 9 CVEs
connman vulnerabilities
It was discovered that ConnMan could be made to write out of bounds. A remote attacker could possibly use this issue to cause ConnMan to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and…
first Jul 19, 2023 -
Critical max 9.8USN-7347-1 3 CVEs
netatalk vulnerabilities
It was discovered that Netatalk did not properly manage memory under certain circumstances. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2024-38439, CVE-2024-38440, CVE-2024-38441)
first Mar 12, 2025 -
Critical max 10.0USN-6125-1 1 CVE
snapd vulnerability
It was discovered that the snap sandbox did not restrict the use of the ioctl system call with a TIOCLINUX request. This could be exploited by a malicious snap to inject commands into the controlling terminal which would then be executed outside of the snap s…
first May 31, 2023 -
Critical max 9.8USN-6038-2 18 CVEs
golang-1.13, golang-1.16 vulnerabilities
USN-6038-1 fixed several vulnerabilities in Go 1.18. This update provides the corresponding updates for Go 1.13 and Go 1.16. CVE-2022-29526 and CVE-2022-30630 only affected Go 1.16. Original advisory details: It was discovered that the Go net/http module inco…
first Jan 9, 2024 -
Critical max 9.8USN-6022-1 2 CVEs
kamailio vulnerabilities
It was discovered that Kamailio did not properly sanitize SIP messages under certain circumstances. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM and 18.04 E…
first Apr 14, 2023 -
Critical max 9.8USN-6017-1 1 CVE
ghostscript vulnerability
Hadrien Perrineau discovered that Ghostscript incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.
first Apr 13, 2023 -
Critical max 9.8USN-5998-1 4 CVEs
apache-log4j1.2 vulnerabilities
It was discovered that the SocketServer component of Apache Log4j 1.2 incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. (CVE-2019-17571) It was discovered that …
first Apr 5, 2023 -
Critical max 10.0USN-5973-1 8 CVEs
node-url-parse vulnerabilities
It was discovered that url-parse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service, or to perform a serve…
first Mar 27, 2023 -
Critical max 9.8
libphp-phpmailer vulnerabilities
Dawid Golunski discovered that PHPMailer was not properly escaping user input data used as arguments to functions executed by the system shell. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. (CV…
first Mar 15, 2023 -
Critical max 9.8USN-5942-2 1 CVE
apache2 vulnerability
USN-5942-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding update for CVE-2023-25690 for Ubuntu 16.04 ESM. Original advisory details: Lars Krapf discovered that the Apache HTTP Server mod_proxy module incorrectly handled ce…
first Mar 22, 2023 -
Critical max 9.8USN-5932-1 5 CVEs
sofia-sip vulnerabilities
It was discovered that Sofia-SIP incorrectly handled specially crafted SDP packets. A remote attacker could use this issue to cause applications using Sofia-SIP to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affe…
first Mar 7, 2023 -
Critical max 9.1USN-5905-1 5 CVEs
php7.0 vulnerabilities
It was discovered that PHP incorrectly handled certain gzip files. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-31628) It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this iss…
first Mar 2, 2023 -
Critical max 9.1USN-7340-1 2 CVEs
openvpn vulnerabilities
It was discovered that OpenVPN did not perform proper input validation when generating a TLS key under certain configuration, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary co…
first Mar 11, 2025 -
Critical max 10.0USN-7309-1 3 CVEs
Ruby SAML vulnerabilities
It was discovered that Ruby SAML did not properly validate SAML responses. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697) It was discovered that Ruby SAML inco…
first Feb 28, 2025