2,451 results · Clear filters · Feed
-
High max 7.5USN-4372-1 5 CVEs
qemu vulnerabilities
It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could use this to cause a denial of service or possibly execute arbitrary code in the host. This issue only affected Ubuntu 19.10. (CVE-2019-15034) It was disco…
first May 21, 2020 -
High max 8.1USN-4599-1 7 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the prompt for opening an external application, obtain sensi…
first Oct 23, 2020 -
High max 7.2USN-4614-1 1 CVE
gdm3 vulnerability
Kevin Backhouse discovered that GDM incorrectly launched the initial setup tool when the accountsservice daemon was not reachable. A local attacker able to cause accountsservice to crash or stop responding could trick GDM into launching the initial setup tool…
first Nov 3, 2020 -
High max 8.8USN-4697-1 3 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tricked into opening a specially-crafted PCX file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. (CVE-202…
first Jan 18, 2021 -
High max 7.5USN-4619-1 1 CVE
dom4j vulnerability
Mário Areias discovered that dom4j did not properly validate XML document elements. An attacker could exploit this with a crafted XML file to cause dom4j to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-1000632)
first Nov 5, 2020 -
High max 7.5USN-4601-1 1 CVE
python-pip vulnerability
It was discovered that pip did not properly sanitize the filename during pip install. A remote attacker could possible use this issue to read and write arbitrary files on the host filesystem as root, resulting in a directory traversal attack. (CVE-2019-20916)
first Oct 22, 2020 -
High max 8.1USN-4584-1 1 CVE
htmlunit vulnerability
It was discovered that HtmlUnit incorrectly initialized Rhino engine. An Attacker could possibly use this issue to execute arbitrary Java code.
first Oct 15, 2020 -
High max 7.3USN-4543-1 1 CVE
ruby-sanitize vulnerability
Michał Bentkowski discovered that Sanitize did not properly sanitize some math or svg HTML under certain circumstances. A remote attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2020-4054)
first Sep 25, 2020 -
High max 8.8USN-4480-1 4 CVEs
keystone vulnerabilities
It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. (CVE-2020-12689, CVE-2020-12691) It was discovered that OpenStack K…
first Sep 1, 2020 -
High max 8.1USN-4430-2 5 CVEs
pillow vulnerabilities
USN-4430-1 fixed vulnerabilities in Pillow. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into …
first Jul 23, 2020 -
High max 8.8USN-4407-1 5 CVEs
libvncserver vulnerabilities
It was discovered that LibVNCServer incorrectly handled decompressing data. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680) It was discovered that an information disclosure vulnerabi…
first Jul 1, 2020 -
High max 8.8USN-4292-1 4 CVEs
rsync vulnerabilities
It was discovered that rsync incorrectly handled pointer arithmetic in zlib. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9840, CVE-2016-9841) It was discovered that …
first Feb 25, 2020 -
High max 7.5USN-4251-1 2 CVEs
tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly handled the RMI registry when configured with the JMX Remote Lifecycle Listener. A local attacker could possibly use this issue to obtain credentials and gain complete control over the Tomcat instance. (CVE-2019-12418…
first Jan 27, 2020 -
High max 7.5USN-4113-1 6 CVEs
apache2 vulnerabilities
Stefan Eissing discovered that the HTTP/2 implementation in Apache did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in some situations. A remote attacker could use this to cause a denial of service (daemon crash). This issue only affected Ubun…
first Aug 29, 2019 -
High max 7.8USN-4072-1 8 CVEs
ansible vulnerabilities
It was discovered that Ansible failed to properly handle sensitive information. A local attacker could use those vulnerabilities to extract them. (CVE-2017-7481) (CVE-2018-10855) (CVE-2018-16837) (CVE-2018-16876) (CVE-2019-10156) It was discovered that Ansibl…
first Jul 24, 2019 -
High max 7.5USN-3727-1 9 CVEs
bouncycastle vulnerabilities
It was discovered that Bouncy Castle incorrectly handled certain crypto algorithms. A remote attacker could possibly use these issues to obtain sensitive information, including private keys.
first Aug 1, 2018 -
High max 8.8USN-4143-1 5 CVEs
SDL 2.0 vulnerabilities
It was discovered that SDL 2.0 mishandled crafted image files resulting in an integer overflow. If a user were tricked into opening a malicious file, SDL 2.0 could be caused to crash or potentially run arbitrary code. (CVE-2017-2888) It was discovered that SD…
first Sep 30, 2019 -
High max 7.5USN-3723-1 2 CVEs
tomcat7, tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly handled decoding certain UTF-8 strings. A remote attacker could possibly use this issue to cause Tomcat to crash, resulting in a denial of service. (CVE-2018-1336) It was discovered that the Tomcat WebSocket client in…
first Jul 25, 2018 -
High max 8.8USN-4246-1 4 CVEs
zlib vulnerabilities
It was discovered that zlib incorrectly handled pointer arithmetic. An attacker could use this issue to cause zlib to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9840, CVE-2016-9841) It was discovered that zlib incor…
first Jan 22, 2020 -
High max 7.5USN-4040-2 1 CVE
expat vulnerability
USN-4040-1 fixed a vulnerability in expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use t…
first Jun 26, 2019 -
High max 7.5USN-4040-1 1 CVE
expat vulnerability
It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to cause a denial of service.
first Jun 26, 2019 -
High max 7.5USN-3964-1 2 CVEs
python-gnupg vulnerabilities
Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain command line parameters. A remote attacker could use this to spoof the output of GnuPG and cause unsigned e-mail to appear signed. (CVE-2018-12020) It was discovered that python-gn…
first May 2, 2019 -
High max 8.8USN-3945-1 6 CVEs
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5 vulnerabilities
It was discovered that Ruby incorrectly handled certain RubyGems. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2019-8320) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issu…
first Apr 11, 2019 -
High max 7.5USN-3790-1 1 CVE
requests vulnerability
It was discovered that Requests incorrectly handled certain HTTP headers. An attacker could possibly use this issue to access sensitive information.
first Oct 15, 2018 -
High max 8.3USN-3751-1 1 CVE
spice, spice-protocol vulnerability
It was discovered that Spice incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service.
first Aug 22, 2018 -
High max 7.5USN-4189-1 1 CVE
dpdk vulnerability
Jason Wang discovered that DPDK incorrectly handled certain messages. An attacker in a malicious container could possibly use this issue to cause DPDK to leak resources, resulting in a denial of service.
first Nov 13, 2019 -
High max 7.8USN-3621-2 1 CVE
ruby1.9.1, ruby2.0 regression
USN-3621-1 fixed vulnerabilities in Ruby. The update caused an issue due to an incomplete patch for CVE-2018-1000074. This update reverts the problematic patch pending further investigation. We apologize for the inconvenience. Original advisory details: It wa…
first Apr 13, 2018 -
High max 7.5USN-4738-1 2 CVEs
openssl, openssl1.0 vulnerabilities
Paul Kehrer discovered that OpenSSL incorrectly handled certain input lengths in EVP functions. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2021-23840) Tavis Ormandy discovered that OpenSSL…
first Feb 18, 2021 -
High max 7.5USN-3365-1 7 CVEs
ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities
It was discovered that Ruby DL::dlopen incorrectly handled opening libraries. An attacker could possibly use this issue to open libraries with tainted names. This issue only applied to Ubuntu 14.04 LTS. (CVE-2009-5147) Tony Arcieri, Jeffrey Walton, and Steffa…
first Jul 25, 2017 -
High max 8.1USN-3045-1 25 CVEs
php5, php7.0 vulnerabilities
It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LT…
first Aug 2, 2016 -
High max 7.3USN-3280-1 1 CVE
batik vulnerability
Lars Krapf and Pierre Ernst discovered that Apache Batik incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from the filesystem, or cause a denial of service.
first May 9, 2017 -
High max 7.3USN-3281-1 1 CVE
fop vulnerability
Pierre Ernst discovered that Apache Fop incorrectly handled XML external entities. A remote attacker could possibly use this issue to obtain sensitive files from the filesystem, or cause a denial of service.
first May 9, 2017 -
High max 7.5USN-4665-2 2 CVEs
curl vulnerabilities
USN-4665-1 fixed several vulnerabilities in curl. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV responses. An attacker…
first Dec 9, 2020 -
High max 7.5USN-5412-1 3 CVEs
curl vulnerabilities
Axel Chong discovered that curl incorrectly handled percent-encoded URL separators. A remote attacker could possibly use this issue to trick curl into using the wrong URL and bypass certain checks or filters. This issue only affected Ubuntu 22.04 LTS. (CVE-20…
first May 11, 2022 -
High max 7.5USN-4665-1 4 CVEs
curl vulnerabilities
Marc Aldorasi discovered that curl incorrectly handled the libcurl CURLOPT_CONNECT_ONLY option. This could result in data being sent to the wrong destination, possibly exposing sensitive information. This issue only affected Ubuntu 20.10. (CVE-2020-8231) Varn…
first Dec 9, 2020 -
High max 7.8USN-3993-1 1 CVE
curl vulnerabilities
Wenchao Li discovered that curl incorrectly handled memory in the curl_url_set() function. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.…
first May 22, 2019 -
High max 7.8USN-3993-2 1 CVE
curl vulnerability
USN-3993-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that curl incorrectly handled memory when receiving data from a TFTP server. A remo…
first May 22, 2019 -
High max 8.8USN-5183-1 1 CVE
bluez vulnerability
Julian Rauchberger discovered that BlueZ incorrectly handled memory when processing SDP attribute requests. A remote attacker could use this issue to cause BlueZ to crash, leading to a denial of service, or possibly execute arbitrary code.
first Dec 8, 2021 -
High max 7.5USN-8050-1 1 CVE
trafficserver vulnerability
Masakazu Kitajo discovered that Apache Traffic Server did not properly handle the Valid Host header field. An attacker could possibly use this issue to cause a denial of service (DoS).
first Feb 18, 2026 -
High max 8.2USN-7953-1 3 CVEs
php7.2, php7.4, php8.1, php8.3, php8.4 vulnerabilities
It was discovered that PHP incorrectly handled memory while reading images in multi-chunk mode. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04 and Ubuntu 25.10. (CVE-2025-1417…
first Jan 12, 2026