2,451 results · Clear filters · Feed
-
High max 7.5USN-5354-1 2 CVEs
twisted vulnerabilities
It was discovered that Twisted incorrectly filtered HTTP headers when clients are being redirected to another origin. A remote attacker could use this issue to obtain sensitive information. (CVE-2022-21712) It was discovered that Twisted incorrectly processed…
first Mar 30, 2022 -
High max 7.8USN-5483-1 22 CVEs
exempi vulnerabilities
It was discovered that Exempi incorrectly handled certain media files. If a user or automated system were tricked into opening a specially crafted file, a remote attacker could cause Exempi to stop responding or crash, resulting in a denial of service, or pos…
first Jun 16, 2022 -
High max 8.1USN-5387-1 2 CVEs
barbican vulnerabilities
Douglas Mendizábal discovered that Barbican incorrectly handled access restrictions. An authenticated attacker could possibly use this issue to consume protected resources and possibly cause a denial of service. (CVE-2022-23451, CVE-2022-23452)
first Apr 25, 2022 -
High max 7.0USN-5305-1 10 CVEs
mariadb-10.3, mariadb-10.5 vulnerabilities
Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.34 in Ubuntu 20.04 LTS and to 10.5.15 in Ubuntu 21.10. In addition to security fixes, the updated p…
first Feb 28, 2022 -
High max 8.1USN-5576-1 1 CVE
twisted vulnerability
It was discovered that Twisted incorrectly parsed some types of HTTP requests in its web server implementation. In certain proxy or multi-server configurations, a remote attacker could craft malicious HTTP requests in order to obtain sensitive information.
first Aug 24, 2022 -
High max 7.5USN-5559-1 2 CVEs
node-moment vulnerabilities
It was discovered that Moment.js incorrectly handled certain input paths. An attacker could possibly use this issue to cause a loss of integrity by changing the correct path to one of their choice. (CVE-2022-24785) It was discovered that Moment.js incorrectly…
first Aug 10, 2022 -
High max 7.5USN-5538-1 1 CVE
libtirpc vulnerability
It was discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
first Jul 28, 2022 -
High max 8.8USN-5509-1 1 CVE
dovecot vulnerability
Julian Brook discovered that Dovecot incorrectly handled multiple passdb configuration entries. In certain configurations, a remote attacker could possibly use this issue to escalate privileges.
first Jul 11, 2022 -
High max 7.5USN-5502-1 1 CVE
openssl vulnerability
Alex Chernyakhovsky discovered that OpenSSL incorrectly handled AES OCB mode when using the AES-NI assembly optimized implementation on 32-bit x86 platforms. A remote attacker could possibly use this issue to obtain sensitive information.
first Jul 5, 2022 -
High max 8.1USN-5479-3 1 CVE
php7.2 regression
USN-5479-1 fixed vulnerabilities in PHP. Unfortunately that update for CVE-2022-31625 was incomplete for Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Charles Fol discovered that PHP incorrectl…
first Jul 7, 2022 -
High max 7.8USN-5141-1 1 CVE
firejail vulnerability
Roman Fiedler discovered that a race condition existed in Firejail when using OverlayFS to prevent writes to the underlying file system. A local attacker could use this to gain administrative privileges. Note: this update disables support for OverlayFS in Fir…
first Nov 11, 2021 -
High max 8.1USN-5479-1 2 CVEs
php7.2, php7.4, php8.0, php8.1 vulnerabilities
Charles Fol discovered that PHP incorrectly handled initializing certain arrays when handling the pg_query_params function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CV…
first Jun 15, 2022 -
High max 7.5USN-5388-1 5 CVEs
openjdk-lts vulnerabilities
It was discovered that OpenJDK incorrectly limited memory when compiling a specially crafted XPath expression. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-21426) It was discovered that OpenJDK incorrectly handled converti…
first Apr 26, 2022 -
High max 7.8USN-5367-1 1 CVE
fish vulnerability
Justin Steven discovered that fish was not properly filtering local git configuration directives when running background git commands. A remote unauthenticated attacker could possibly use this issue to execute arbitrary code.
first Aug 10, 2022 -
High max 7.8USN-5427-1 8 CVEs
apport vulnerabilities
Muqing Liu and neoni discovered that Apport incorrectly handled detecting if an executable was replaced after a crash. A local attacker could possibly use this issue to execute arbitrary code as the root user. (CVE-2021-3899) Gerrit Venema discovered that App…
first May 17, 2022 -
High max 7.5USN-5088-1 4 CVEs
edk2 vulnerabilities
It was discovered that EDK II incorrectly handled input validation in MdeModulePkg. A local user could possibly use this issue to cause EDK II to crash, resulting in a denial of service, obtain sensitive information or execute arbitrary code. (CVE-2019-11098)…
first Sep 23, 2021 -
High max 8.0USN-4943-1 14 CVEs
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. This issue affected only affected Ubuntu 20.10. (CVE-2020-26217) It was discov…
first May 11, 2021 -
High max 7.5USN-4882-1 3 CVEs
ruby2.3, ruby2.5, ruby2.7 vulnerabilities
It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated system were tricked into parsing a specially crafted JSON file, a remote attacker could use this issue to execute arbitrary code. This issue only affected …
first Mar 18, 2021 -
High max 7.8
sudo vulnerabilities
It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156) It was discovered that the Sudo sudoedit utility incorr…
first Jan 26, 2021 -
High max 7.5USN-4691-1 2 CVEs
openvswitch vulnerabilities
Jonas Rudloff discovered that Open vSwitch incorrectly handled certain malformed LLDP packets. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jan 13, 2021 -
High max 7.1USN-5270-1 26 CVEs
mysql-5.7, mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.28 in Ubuntu 20.04 LTS and Ubuntu 21.10. Ubuntu 18.04 LTS has been updated to MySQL 5.7.37. In addition t…
first Feb 3, 2022 -
High max 8.2USN-5283-1 1 CVE
node-tar vulnerability
It was discovered that Tar for Node.js did not properly sanitize path inputs. An attacker could possibly use this issue to read arbitrary files, resulting in a directory traversal attack.
first Feb 11, 2022 -
High max 7.5USN-5204-1 3 CVEs
python-django vulnerabilities
Chris Bailey discovered that Django incorrectly handled evaluating submitted passwords. A remote attacker could possibly use this issue to consume resources, resulting in a denial of service. (CVE-2021-45115) Dennis Brinkrolf discovered that Django incorrectl…
first Jan 5, 2022 -
High max 7.1USN-5123-1 43 CVEs
mysql-5.7, mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.27 in Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. Ubuntu 18.04 LTS has been updated to MySQL 5.7.36…
first Oct 25, 2021 -
High max 7.5USN-5080-1 2 CVEs
libgcrypt20 vulnerabilities
It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An attacker could possibly use this issue to recover sensitive information.
first Sep 16, 2021 -
High max 7.4USN-5051-3 1 CVE
openssl1.0 vulnerability
USN-5051-1 fixed a vulnerability in OpenSSL. This update provides the corresponding update for the openssl1.0 package in Ubuntu 18.04 LTS. Original advisory details: Ingo Schwarze discovered that OpenSSL incorrectly handled certain ASN.1 strings. A remote att…
first Aug 26, 2021 -
High max 7.1USN-5052-1 1 CVE
mongodb vulnerability
MongoDB would fail to properly invalidate existing sessions for deleted users. This could allow a remote authenticated attacker to gain elevated privileges if their user account was recreated with elevated privileges.
first Aug 26, 2021 -
High max 7.1USN-5027-1 1 CVE
php-pear vulnerability
It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute arbitrary code.
first Jul 29, 2021 -
High max 7.5USN-4897-1 1 CVE
pygments vulnerability
Ben Caller discovered that Pygments incorrectly handled parsing certain files. If a user or automated system were tricked into parsing a specially crafted file, a remote attacker could cause Pygments to hang or consume resources, resulting in a denial of serv…
first Mar 30, 2021 -
High max 7.5USN-4866-1 4 CVEs
netty vulnerabilities
It was discovered that Netty incorrectly implements HTTP/2. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515, CVE-2019-9518)
first Jun 29, 2021 -
High max 7.1USN-4697-2 2 CVEs
pillow vulnerabilities
USN-4697-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tr…
first Jan 20, 2021 -
High max 8.1USN-4599-2 7 CVEs
firefox vulnerabilities
USN-4599-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubuntu 16.04 LTS. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website,…
first Oct 26, 2020 -
High max 7.5USN-4596-1 4 CVEs
tomcat9 vulnerabilities
It was discovered that Tomcat did not properly manage HTTP/2 streams. An attacker could possibly use this to cause Tomcat to consume resources, resulting in a denial of service. (CVE-2020-11996) It was discovered that Tomcat did not properly release the HTTP/…
first Oct 21, 2020 -
High max 7.8USN-4269-1 5 CVEs
systemd vulnerabilities
It was discovered that systemd incorrectly handled certain PIDFile files. A local attacker could possibly use this issue to trick systemd into killing privileged processes. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-16888) It was discovered that sys…
first Feb 5, 2020 -
High max 8.1USN-4257-1 8 CVEs
openjdk-8, openjdk-lts vulnerabilities
It was discovered that OpenJDK incorrectly handled exceptions during deserialization in BeanContextSupport. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. (CVE-2020-2583) It was discovered that OpenJDK inco…
first Jan 28, 2020 -
High max 8.1
thunderbird vulnerabilities
It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792) Mutiple security issues were discovered in Thunderbird. If a user were tricked in to ope…
first Apr 13, 2020 -
High max 7.5USN-4448-1 3 CVEs
tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly validated the payload length in a WebSocket frame. A remote attacker could possibly use this issue to cause Tomcat to hang, resulting in a denial of service. (CVE-2020-13935) It was discovered that Tomcat incorrectly …
first Aug 4, 2020 -
High max 8.8
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass sec…
first Apr 21, 2020 -
High max 7.7USN-4283-1 3 CVEs
qemu vulnerabilities
Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that QEMU incorrectly handled iSCSI server responses. A remote attacker in control of the iSCSI server could use this issue to cause QEMU to crash, leading to a denial of service, or possibly e…
first Feb 18, 2020 -
High max 8.8USN-4238-1 12 CVEs
sdl-image1.2 vulnerabilities
It was discovered that SDL_image incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.
first Jan 14, 2020