1,460 results · Clear filters · Feed
-
Critical max 9.8USN-6059-1 1 CVE
erlang vulnerability
It was discovered that Erlang did not properly implement TLS client certificate validation during the TLS handshake. A remote attacker could use this issue to bypass client authentication.
first May 8, 2023 -
Critical max 9.1USN-6036-1 1 CVE
patchelf vulnerability
It was discovered that PatchELF was not properly performing bounds checks, which could lead to an out-of-bounds read via a specially crafted file. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-…
first Apr 20, 2023 -
Critical max 9.8USN-5931-1 1 CVE
python3.8 vulnerability
It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2022-37454)
first Mar 7, 2023 -
Critical max 9.8USN-5930-1 1 CVE
python3.7 vulnerability
It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2022-37454)
first Mar 7, 2023 -
Critical max 9.8USN-5822-1 7 CVEs
samba vulnerabilities
It was discovered that Samba incorrectly handled the bad password count logic. A remote attacker could possibly use this issue to bypass bad passwords lockouts. This issue was only addressed in Ubuntu 22.10. (CVE-2021-20251) Evgeny Legerov discovered that Sam…
first Jan 24, 2023 -
Critical max 9.8USN-5726-1 19 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the contents of the addressbar, bypass security restrictions,…
first Nov 16, 2022 -
Critical max 9.8USN-5823-1 20 CVEs
mysql-5.7, mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.32 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. Ubuntu 18.04 LTS has been updated to MySQL 5.…
first Jan 24, 2023 -
Critical max 9.8USN-5717-1 4 CVEs
php7.2, php7.4, php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain gzip files. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-31628) It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this iss…
first Nov 8, 2022 -
Critical max 9.0USN-5839-1 3 CVEs
apache2 vulnerabilities
It was discovered that the Apache HTTP Server mod_dav module incorrectly handled certain If: request headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2006-20001) ZeddYu_Lu discovered…
first Feb 1, 2023 -
Critical max 9.1USN-5818-1 1 CVE
php7.2, php7.4, php8.1 vulnerability
It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
first Jan 23, 2023 -
Critical max 9.8USN-5767-3 1 CVE
python3.6 vulnerability
USN-5767-1 fixed vulnerabilities in Python. This update fixes the problem for Ubuntu 18.04 LTS. Original advisory details: Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals. An attacker could possibly use this issue to cause a cra…
first Mar 6, 2023 -
Critical max 9.8USN-5767-1 2 CVEs
python2.7, python3.10, python3.6, python3.8 vulnerabilities
Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-37454) It was discovered that Python incorrectly handled certain IDNA inputs. An at…
first Dec 8, 2022 -
Critical max 9.8USN-5227-1 5 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437) It was di…
first Jan 13, 2022 -
Critical max 9.8USN-5402-1 4 CVEs
openssl, openssl1.0 vulnerabilities
Elison Niven discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. (CVE-2022-1292) Raul Metsma discovered that OpenSSL incorrectly verified certain r…
first May 4, 2022 -
Critical max 9.8USN-5488-1 1 CVE
openssl, openssl1.0 vulnerability
Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run.
first Jun 21, 2022 -
Critical max 9.1USN-5461-1 2 CVEs
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled empty password values. A remote attacker could use this issue to bypass server authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-24882) It was discovered…
first Jun 6, 2022 -
Critical max 9.8USN-5107-1 7 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof another origin, or execute arbitrary code.
first Oct 7, 2021 -
Critical max 9.8USN-5227-3 1 CVE
pillow vulnerability
USN-5227-1 fixed vulnerabilities in Pillow. It was discovered that the fix for CVE-2022-22817 was incomplete. This update fixes the problem. Original advisory details: It was discovered that Pillow incorrectly handled certain image files. If a user or automat…
first Oct 24, 2022 -
Critical max 9.8USN-4741-1 3 CVEs
libjackson-json-java vulnerabilities
It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.
first Feb 18, 2021 -
Critical max 9.1USN-4963-1 6 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash or hand, resulting in a denial of service.
first May 19, 2021 -
Critical max 9.8USN-4763-1 8 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain Tiff image files. If a user or automated system were tricked into opening a specially-crafted Tiff file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly exe…
first Mar 11, 2021 -
Critical max 9.8USN-4740-1 2 CVEs
shiro vulnerabilities
It was discovered that Apache Shiro mishandled specially crafted requests. An attacker could use this vulnerability to bypass authentication mechanisms.
first Feb 18, 2021 -
Critical max 9.8
salt vulnerabilities
It was discovered that Salt allows remote attackers to determine which files exist on the server. An attacker could use that to extract sensitive information. (CVE-2018-15750) It was discovered that Salt has a vulnerability that allows an user to bypass authe…
first Aug 13, 2020 -
Critical max 9.8
tomcat6 vulnerabilities
It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use this issue to enumerate usernames. (CVE-2016-0762) Alvaro Munoz and Alexander Mirosh discovered that Tomca…
first Sep 30, 2020 -
Critical max 9.8USN-5248-1 44 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, trick a use…
first Jan 21, 2022 -
Critical max 9.8USN-4308-1 7 CVEs
twisted vulnerabilities
it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387) It was discovered that Twisted …
first Mar 19, 2020 -
Critical max 9.8USN-4699-1 1 CVE
log4net vulnerability
It was discovered that Apache Log4net incorrectly handled certain configuration files. An attacker could possibly use this issue to expose sensitive information.
first Jan 19, 2021 -
Critical max 9.1USN-4600-2 3 CVEs
netty vulnerabilities
USN-4600-1 fixed multiple vunerabilities in Netty 3.9. This update provides the corresponding fixes for CVE-2019-20444, CVE-2019-20445 for Netty. Also it was discovered that Netty allow for unbounded memory allocation. A remote attacker could send a large str…
first Oct 27, 2020 -
Critical max 9.8USN-4562-1 1 CVE
ruby-kramdown vulnerability
It was discovered that kramdown insecurely handled certain crafted input. An attacker could use this vulnerability to read restricted files or execute arbitrary code.
first Sep 30, 2020 -
Critical max 9.8USN-4575-1 1 CVE
dom4j vulnerability
It was discovered that dom4j incorrectly handled reading XML data. A remote attacker could exploit this with a crafted XML file to expose sensitive data or possibly execute arbitrary code. (CVE-2020-10683)
first Oct 13, 2020 -
Critical max 9.1USN-4532-1 3 CVEs
netty-3.9 vulnerabilities
It was discovered that Netty incorrectly handled certain HTTP headers. By sending an HTTP header with whitespace before the colon, a remote attacker could possibly use this issue to perform an HTTP request smuggling attack. (CVE-2019-16869) It was discovered …
first Sep 22, 2020 -
Critical max 9.1USN-4600-1 4 CVEs
netty-3.9 vulnerabilities
It was discovered that Netty had HTTP request smuggling vulnerabilities. A remote attacker could used it to extract sensitive information. (CVE-2019-16869, CVE-2019-20444, CVE-2019-20445, CVE-2020-7238)
first Oct 22, 2020 -
Critical max 9.8USN-4288-1 1 CVE
ppp vulnerability
It was discovered that ppp incorrectly handled certain rhostname values. A remote attacker could use this issue to cause ppp to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Feb 20, 2020 -
Critical max 9.8USN-4288-2 1 CVE
ppp vulnerability
USN-4288-1 fixed a vulnerability in ppp. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that ppp incorrectly handled certain rhostname values. A remote attacker could use t…
first Mar 2, 2020 -
Critical max 9.8USN-3685-1 9 CVEs
ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities
Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) It…
first Jun 13, 2018 -
Critical max 9.8
tomcat7, tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly handled being configured with HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP file to the server and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ub…
first May 30, 2018 -
Critical max 9.8USN-3439-1 7 CVEs
ruby1.9.1 vulnerabilities
It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) Yusuke Endoh discovered that Ruby incorrectly handled certain files. An attacker could use this to execute terminal escape se…
first Oct 5, 2017 -
Critical max 9.8USN-3990-1 3 CVEs
python-urllib3 vulnerabilities
It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (…
first May 21, 2019 -
Critical max 9.8USN-4084-1 4 CVEs
python-django vulnerabilities
It was discovered that Django incorrectly handled the Truncator function. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. (CVE-2019-14232) It was discovered that Django incorrectly handled …
first Aug 1, 2019 -
Critical max 9.8USN-3685-2 1 CVE
ruby2.0 regression
USN-3685-1 fixed a vulnerability in Ruby. The fix for CVE-2017-0903 introduced a regression in Ruby. This update fixes the problem. Original advisory details: Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address fo…
first Mar 25, 2021