2,451 results · Clear filters · Feed
-
High max 7.5USN-6642-1 5 CVEs
bind9 vulnerabilities
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023…
first Feb 19, 2024 -
High max 7.5USN-6593-1 2 CVEs
gnutls28 vulnerabilities
It was discovered that GnuTLS had a timing side-channel when processing malformed ciphertexts in RSA-PSK ClientKeyExchange. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2024-0553) It was discovered that GnuTLS incorre…
first Jan 22, 2024 -
High max 8.6USN-6728-1 5 CVEs
squid vulnerabilities
Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-…
first Apr 10, 2024 -
High max 8.8USN-6717-1 9 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass secu…
first Mar 26, 2024 -
High max 7.5USN-6633-1 5 CVEs
bind9 vulnerabilities
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023…
first Feb 13, 2024 -
High max 7.5USN-6567-1 11 CVEs
qemu vulnerabilities
Gaoning Pan and Xingwei Li discovered that QEMU incorrectly handled the USB xHCI controller device. A privileged guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS and…
first Jan 8, 2024 -
High max 7.5USN-6690-1 2 CVEs
openvswitch vulnerabilities
Timothy Redaelli and Haresh Khandelwal discovered that Open vSwitch incorrectly handled certain crafted Geneve packets when hardware offloading via the netlink path is enabled. A remote attacker could possibly use this issue to cause Open vSwitch to crash, le…
first Mar 12, 2024 -
High max 8.6USN-6718-3 2 CVEs
curl vulnerabilities
USN-6718-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Dan Fandrich discovered that curl would incorrectly use the default set of protocols when a parameter option disabled all…
first Apr 29, 2024 -
High max 7.5USN-6672-1 3 CVEs
nodejs vulnerabilities
Morgan Jones discovered that Node.js incorrectly handled certain inputs that leads to false positive errors during some cryptographic operations. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker coul…
first Mar 4, 2024 -
High max 7.5USN-6657-1 3 CVEs
dnsmasq vulnerabilities
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Dnsmasq icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE…
first Feb 26, 2024 -
High max 7.1USN-6836-1 1 CVE
sssd vulnerability
It was discovered that SSSD did not always correctly apply the GPO policy for authenticated users, contrary to expectations. This could result in improper authorization or improper access to resources.
first Jun 17, 2024 -
High max 7.8USN-6798-1 1 CVE
gst-plugins-base1.0 vulnerability
It was discovered that GStreamer Base Plugins incorrectly handled certain EXIF metadata. An attacker could possibly use this issue to execute arbitrary code or cause a crash.
first May 29, 2024 -
High max 7.5USN-6791-1 1 CVE
unbound vulnerability
It was discovered that Unbound could take part in a denial of service amplification attack known as DNSBomb. This update introduces certain resource limits to make the impact from Unbound significantly lower.
first May 28, 2024 -
High max 7.4USN-6790-1 1 CVE
amavisd-new vulnerability
It was discovered that amavisd-new incorrectly handled certain MIME email messages with multiple boundary parameters. A remote attacker could possibly use this issue to bypass checks for banned files or malware.
first May 28, 2024 -
High max 7.6USN-6784-1 3 CVEs
cjson vulnerabilities
It was discovered that cJSON incorrectly handled certain input. An attacker could possibly use this issue to cause cJSON to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-50471, CVE-2023-50472) L…
first May 23, 2024 -
High max 7.3USN-6737-2 1 CVE
glibc vulnerability
USN-6737-1 fixed a vulnerability in the GNU C Library. This update provides the corresponding update for Ubuntu 24.04 LTS. Original advisory details: Charles Fol discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An a…
first Apr 29, 2024 -
High max 7.5USN-6746-2 1 CVE
google-guest-agent, google-osconfig-agent vulnerability
USN-6746-1 fixed vulnerabilities in Google Guest Agent and Google OS Config Agent. This update provides the corresponding update for Ubuntu 24.04 LTS. Original advisory details: It was discovered that Google Guest Agent and Google OS Config Agent incorrectly …
first Jun 25, 2024 -
High max 7.1USN-6758-1 1 CVE
node-json5 vulnerability
It was discovered that the JSON5 parse method incorrectly handled the parsing of keys named \_\_proto\_\_. An attacker could possibly use this issue to pollute the prototype of the returned object, setting arbitrary or unexpected keys, and cause a denial of s…
first Apr 30, 2024 -
High max 7.3USN-6737-1 1 CVE
glibc vulnerability
Charles Fol discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Apr 18, 2024 -
High max 7.5USN-6729-3 3 CVEs
apache2 vulnerabilities
USN-6729-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Orange Tsai discovered that the Apache HTTP Server incorrectly handled validating certain input. A remote a…
first Apr 29, 2024 -
High max 7.5USN-6746-1 1 CVE
google-guest-agent, google-osconfig-agent vulnerability
It was discovered that Google Guest Agent and Google OS Config Agent incorrectly handled certain JSON files. An attacker could possibly use this issue to cause a denial of service.
first Apr 23, 2024 -
High max 7.5USN-6729-1 3 CVEs
apache2 vulnerabilities
Orange Tsai discovered that the Apache HTTP Server incorrectly handled validating certain input. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2023-38709) Keran Mu and Jianjun Chen discovered that the Apache H…
first Apr 11, 2024 -
High max 8.6USN-6728-3 2 CVEs
squid vulnerability
USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused Squid to crash in certain environments on Ubuntu 20.04 LTS and was disabled in USN-6728-2. The problematic fix for CVE-2023-5824 has now been corrected and reinstated in this update. …
first Apr 23, 2024 -
High max 7.8USN-6711-1 1 CVE
crmsh vulnerability
Vincent Berg discovered that CRM shell incorrectly handled certain commands. An local attacker could possibly use this issue to execute arbitrary code via shell code injection to the crm history commandline.
first Mar 25, 2024 -
High max 7.4USN-6696-1 6 CVEs
openjdk-8 vulnerabilities
Yi Yang discovered that the Hotspot component of OpenJDK 8 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-209…
first Mar 18, 2024 -
High max 7.5USN-6694-1 2 CVEs
expat vulnerabilities
It was discovered that Expat could be made to consume large amounts of resources. If a user or automated system were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service. (CVE-2023-52425, CVE-…
first Mar 14, 2024 -
High max 7.4USN-6660-1 6 CVEs
openjdk-lts vulnerabilities
Yi Yang discovered that the Hotspot component of OpenJDK 11 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20…
first Feb 27, 2024 -
High max 7.4USN-6662-1 5 CVEs
openjdk-21 vulnerabilities
Yi Yang discovered that the Hotspot component of OpenJDK 21 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20…
first Feb 27, 2024 -
High max 8.0USN-6656-1 1 CVE
postgresql-12, postgresql-14, postgresql-15 vulnerability
It was discovered that PostgreSQL incorrectly handled dropping privileges when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands. If a user or automatic system were tricked into running a specially crafted command, a remote attacker could possibly use …
first Feb 26, 2024 -
High max 7.5USN-6670-1 2 CVEs
php-guzzlehttp-psr7 vulnerabilities
It was discovered that php-guzzlehttp-psr7 incorrectly parsed HTTP headers. A remote attacker could possibly use these issues to perform an HTTP header injection attack.
first Feb 29, 2024 -
High max 7.5USN-6665-1 2 CVEs
unbound vulnerabilities
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Unbound incorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. (CV…
first Feb 28, 2024 -
High max 7.5USN-6661-1 6 CVEs
openjdk-17 vulnerabilities
Yi Yang discovered that the Hotspot component of OpenJDK 17 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20…
first Feb 27, 2024 -
High max 7.5USN-6629-3 2 CVEs
ujson vulnerabilities
USN-6629-1 fixed vulnerabilities in UltraJSON. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: It was discovered that UltraJSON incorrectly handled certain input with a large amount of indentation. An attacker c…
first Feb 14, 2024 -
High max 8.3USN-6638-1 10 CVEs
edk2 vulnerabilities
Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the local network could potentially use this to impact availability or possibly cause remote code execution. (CVE-2022-36763, CVE-2022-36764, CVE-2022-36765) It was discovered that a buffer…
first Feb 15, 2024 -
High max 8.1USN-6618-1 2 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CV…
first Jan 30, 2024 -
High max 7.5USN-6623-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain inputs that uses intcomma template filter. An attacker could possibly use this issue to cause a denial of service.
first Feb 6, 2024 -
High max 8.8
libvpx vulnerabilities
USN-6403-1 fixed several vulnerabilities in libvpx. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: It was discovered that libvpx did not properly handle certain malformed media files. If an application using lib…
first Oct 23, 2023 -
High max 7.5USN-6296-1 1 CVE
postgresql-12, postgresql-14, postgresql-15 vulnerabilities
It was discovered that PostgreSQL incorrectly handled certain extension script substitutions. An attacker having database-level CREATE privileges can use this issue to execute arbitrary code as the bootstrap superuser. (CVE-2023-39417) It was discovered that …
first Aug 17, 2023 -
High max 8.8USN-6429-1 2 CVEs
curl vulnerabilities
Jay Satiro discovered that curl incorrectly handled hostnames when using a SOCKS5 proxy. In environments where curl is configured to use a SOCKS5 proxy, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu…
first Oct 11, 2023 -
High max 7.8USN-6521-1 6 CVEs
gimp vulnerabilities
It was discovered that GIMP incorrectly handled certain image files. If a user were tricked into opening a specially crafted image, an attacker could use this issue to cause GIMP to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 29, 2023