2,451 results · Clear filters · Feed
-
High max 8.2
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is…
first Nov 17, 2025 -
High max 7.8LSN-0104-1 4 CVEs
Kernel Live Patch Security Notice
It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code.(CVE-2023-6270) It …
first Jun 10, 2024 -
High max 7.8
Kernel Live Patch Security Notice
Lonial Con discovered that the netfilter subsystem in the Linux kernel contained a memory leak when handling certain element flush operations. A local attacker could use this to expose sensitive information (kernel memory).(CVE-2023-4569) Xingyuan Mo discover…
first Apr 30, 2024 -
High max 7.8LSN-0101-1 5 CVEs
Kernel Live Patch Security Notice
Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system cra…
first Mar 12, 2024 -
High max 7.8LSN-0097-1 7 CVEs
Kernel Live Patch Security Notice
It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly …
first Sep 5, 2023 -
High max 7.8LSN-0096-1 5 CVEs
Kernel Live Patch Security Notice
It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could c…
first Jul 25, 2023 -
High max 8.8LSN-0091-1 2 CVEs
Kernel Live Patch Security Notice
It was discovered that a race condition existed in the memory address space accounting implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execu…
first Feb 14, 2023 -
High max 8.6
Kernel Live Patch Security Notice
It was discovered that a race condition existed in the network scheduling subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.…
first Jun 2, 2022 -
High max 7.8
Kernel Live Patch Security Notice
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges.(CVE-2022-0492) Nick Gregory dis…
first Mar 23, 2022 -
High max 8.4
Kernel Live Patch Security Notice
William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system c…
first Jan 20, 2022 -
High max 8.3
Kernel Live Patch Security Notice
The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.…
first Jan 6, 2022 -
High max 7.8LSN-0082-1 4 CVEs
Kernel Live Patch Security Notice
Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensi…
first Nov 11, 2021 -
High max 8.3
Kernel Live Patch Security Notice
Maxim Levitsky discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel did not properly prevent a guest VM from enabling AVIC in nested guest VMs. An attacker in a guest VM could use this to write to portions of the host's phy…
first Sep 13, 2021 -
High max 8.3
Kernel Live Patch Security Notice
Andy Nguyen discovered that the netfilter subsystem in the Linux kernel contained an out-of-bounds write in its setsockopt() implementation. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-20…
first Aug 16, 2021 -
High max 7.8LSN-0079-1 2 CVEs
Kernel Live Patch Security Notice
It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.(CVE-2021-3600) It was…
first Jul 26, 2021 -
High max 8.8LSN-0077-1 1 CVE
Kernel Live Patch Security Notice
Vincent Dehors discovered that the shiftfs file system in the Ubuntu Linux kernel did not properly handle faults in copy_from_user() when passing through ioctls to an underlying file system. A local attacker could use this to cause a denial of service (memory…
first May 17, 2021 -
High max 8.8
Kernel Live Patch Security Notice
It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges.(CVE-2021-3493) Piotr Kr…
first May 3, 2021 -
High max 7.7USN-8372-1 1 CVE
age vulnerability
It was discovered that age did not properly validate plugin names. An attacker could possibly use this issue to cause execution of an arbitrary program by supplying a crafted recipient or identity string.
-
High max 8.6USN-8238-2 1 CVE
editorconfig-core vulnerability
USN-8238-1 fixed a vulnerability in EditorConfig. This update contains the corresponding fix for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Original advisory details: It was discovered that EditorConfig incorrectly handled spe…
-
High max 8.7USN-8367-1 3 CVEs
node-tar-fs vulnerabilities
It was discovered that tar-fs did not properly limit paths when extracting crafted tar files. An attacker could possibly use this issue to write or overwrite files outside the intended extraction directory. This issue only affected Ubuntu 22.04 LTS and Ubuntu…
-
High max 7.8USN-8358-1 1 CVE
haveged vulnerability
It was discovered that haveged incorrectly handled credential checks on its control socket. A local attacker could possibly use this issue to execute privileged commands.
-
High max 7.5USN-8356-1 1 CVE
gsasl vulnerability
It was discovered that GNU SASL did not properly handle certain DIGEST-MD5 tokens. An attacker could possibly use this issue to cause GNU SASL to crash, resulting in a denial of service.
-
High max 8.7USN-8357-1 1 CVE
qtdeclarative-opensource-src vulnerability
It was discovered that Qt Declarative did not properly validate the width and height attributes of image tags in the Text component of Qt Quick. An attacker could possibly use this issue to cause Qt Declarative to use excessive resources, leading to a denial …
-
High max 7.9USN-3981-2 9 CVEs
linux-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities
USN-3981-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04…
first May 15, 2019 -
High max 7.9USN-3981-1 9 CVEs
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michae…
first May 14, 2019 -
High max 7.9USN-3980-2 10 CVEs
linux-hwe, linux-azure vulnerabilities
USN-3980-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS. Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, G…
first May 14, 2019 -
High max 7.8USN-3538-1 5 CVEs
openssh vulnerabilities
Jann Horn discovered that OpenSSH incorrectly loaded PKCS#11 modules from untrusted directories. A remote attacker could possibly use this issue to execute arbitrary PKCS#11 modules. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10…
first Jan 22, 2018 -
High max 7.5USN-3270-1 2 CVEs
nss vulnerabilities
Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update causes NSS to limit use…
first Apr 27, 2017 -
High max 7.5USN-3194-1 12 CVEs
openjdk-7 vulnerabilities
Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms …
first Feb 9, 2017 -
High max 7.5USN-3179-1 13 CVEs
openjdk-8 vulnerabilities
Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms …
first Jan 25, 2017 -
High max 7.5USN-3087-1 11 CVEs
openssl vulnerabilities
Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. (CVE-2016-6304) Guido Vranken discovered that OpenSSL used un…
first Sep 22, 2016 -
High max 8.1USN-2869-1 2 CVEs
openssh vulnerabilities
It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use this issue to leak client memory to the server, including private client user keys.
first Jan 14, 2016 -
High max 8.1USN-6355-1 10 CVEs
grub2-signed, grub2-unsigned, shim, and shim-signed vulnerability
Daniel Axtens discovered that specially crafted images could cause a heap-based out-of-bonds write. A local attacker could possibly use this to circumvent secure boot protections. (CVE-2021-3695) Daniel Axtens discovered that specially crafted images could ca…
first Sep 8, 2023 -
High max 7.5USN-5546-1 10 CVEs
openjdk-8, openjdk-lts, openjdk-17, openjdk-18 vulnerabilities
Neil Madden discovered that OpenJDK did not properly verify ECDSA signatures. A remote attacker could possibly use this issue to insert, edit or obtain sensitive information. This issue only affected OpenJDK 17 and OpenJDK 18. (CVE-2022-21449) It was discover…
first Aug 4, 2022 -
High max 8.1USN-5397-1 4 CVEs
curl vulnerabilities
Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2. An attacker could possibly use this issue to access sensitive information. (CVE-2022-22576) Harry Sintonen discovered that curl incorrectly handled certain requests. An attacker could p…
first Apr 28, 2022 -
High max 7.5USN-5223-1 1 CVE
apache-log4j1.2 vulnerability
It was discovered that Apache Log4j 1.2 was vulnerable to deserialization of untrusted data if the configuration file was editable. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code.
first Jan 12, 2022 -
High max 8.1USN-2710-1 2 CVEs
openssh vulnerabilities
Moritz Jodeit discovered that OpenSSH incorrectly handled usernames when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to perform user impersonation…
first Aug 14, 2015 -
High max 7.0USN-8326-1 2 CVEs
foomuuri vulnerabilities
Matthias Gerstner discovered that Foomuuri's D-Bus service did not properly enforce authorization. An unprivileged local attacker could possibly use this issue to manipulate the firewall configuration, contrary to expectations. (CVE-2025-67603) Matthias Gerst…
-
High max 8.4USN-8324-1 2 CVEs
tika vulnerabilities
It was discovered that Apache Tika incorrectly handled XML external entities when parsing XFA content in PDF files. An attacker could possibly use this issue to obtain sensitive information or send malicious requests to internal resources or third-party serve…
-
High max 7.2USN-8323-1 1 CVE
postorius vulnerability
It was discovered that Postorius did not properly escape HTML in message subjects when rendering the Held messages pop-up. An attacker could possibly use this issue to inject arbitrary HTML, resulting in exposure of sensitive information.