2,451 results · Clear filters · Feed
-
High max 8.8USN-4047-1 3 CVEs
libvirt vulnerabilities
Matthias Gerstner and Ján Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to check for arbitrary files, or execute arbitrary binaries. In the default installation, attackers would be isolated by t…
first Jul 8, 2019 -
High max 7.5USN-4035-1 4 CVEs
ceph vulnerabilities
It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662) It was discovered that Ceph incorrectly handl…
first Jun 25, 2019 -
High max 7.5USN-4027-1 1 CVE
postgresql-10, postgresql-11 vulnerability
Alexander Lakhin discovered that PostgreSQL incorrectly handled authentication. An authenticated attacker or a rogue server could use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. The default co…
first Jun 20, 2019 -
High max 7.1USN-4015-2 1 CVE
dbus vulnerability
USN-4015-1 fixed a vulnerability in DBus. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Joe Vennix discovered that DBus incorrectly handled DBUS_COOKIE_SHA1 authentication. A local attacker…
first Jun 12, 2019 -
High max 8.8
firefox vulnerability
A type confusion bug was discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this by causing a denial of service, or executing arbitrary code.
first Jun 19, 2019 -
High max 7.1USN-4015-1 1 CVE
dbus vulnerability
Joe Vennix discovered that DBus incorrectly handled DBUS_COOKIE_SHA1 authentication. A local attacker could possibly use this issue to bypass authentication and connect to DBus servers with elevated privileges.
first Jun 11, 2019 -
High max 7.5USN-4017-1 2 CVEs
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Jonathan Looney discovered that the TCP retransmission queue implementation in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (CVE-2019-1…
first Jun 17, 2019 -
High max 7.5USN-4017-2 2 CVEs
linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities
USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. This update provides the corresponding updates for the Linux kernel for Ubuntu 16.04 ESM and Ubuntu 14.04 ESM. Jonathan Looney discovered that the TCP retransmission queue implementation in the …
first Jun 17, 2019 -
High max 8.8USN-4047-2 1 CVE
libvirt vulnerability
USN-4047-1 fixed a vulnerability in libvirt. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Matthias Gerstner and Ján Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possib…
first Jan 13, 2020 -
High max 7.5USN-4000-1 1 CVE
corosync vulnerability
It was discovered that Corosync incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first May 30, 2019 -
High max 7.5USN-3976-2 1 CVE
samba vulnerability
USN-3976-1 fixed a vulnerability in Samba. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Isaac Boukris and Andrew Bartlett discovered that Samba incorrectly checked S4U2Self packets. In cer…
first May 14, 2019 -
High max 7.3USN-3970-1 1 CVE
ghostscript vulnerability
It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to access arbitrary files, execute arbitrary …
first May 8, 2019 -
High max 8.8USN-3952-1 3 CVEs
pacemaker vulnerabilities
Jan Pokorný discovered that Pacemaker incorrectly handled client-server authentication. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-16877) Jan Pokorný discovered that Pacemaker incorrectly handled certain verifications. A …
first Apr 23, 2019 -
High max 7.5USN-3976-1 1 CVE
samba vulnerability
Isaac Boukris and Andrew Bartlett discovered that Samba incorrectly checked S4U2Self packets. In certain environments, a remote attacker could possibly use this issue to escalate privileges.
first May 14, 2019 -
High max 7.5USN-3956-2 1 CVE
bind9 vulnerability
USN-3956-1 fixed a vulnerability in Bind. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Bind incorrectly handled limiting the number of simultaneous TCP clients. A re…
first May 9, 2019 -
High max 7.5USN-3893-1 3 CVEs
bind9 vulnerabilities
Toshifumi Sakaguchi discovered that Bind incorrectly handled memory. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-5744…
first Feb 22, 2019 -
High max 8.8USN-3928-1 1 CVE
dovecot vulnerability
It was discovered that Dovecot incorrectly handled reading certain headers from the index. A local attacker could possibly use this issue to escalate privileges.
first Apr 1, 2019 -
High max 7.5USN-3956-1 1 CVE
bind9 vulnerability
It was discovered that Bind incorrectly handled limiting the number of simultaneous TCP clients. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service.
first Apr 25, 2019 -
High max 7.8
apache2 vulnerabilities
Charles Fol discovered that the Apache HTTP Server incorrectly handled the scoreboard shared memory area. A remote attacker able to upload and run scripts could possibly use this issue to execute arbitrary code with root privileges. (CVE-2019-0211) It was dis…
first Apr 4, 2019 -
High max 8.8
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …
first Apr 16, 2019 -
High max 7.5USN-3940-1 3 CVEs
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled scanning certain PDF documents. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2019-1787) It was discovered that ClamAV incorrectly handled sca…
first Apr 8, 2019 -
High max 7.3USN-3915-1 2 CVEs
ghostscript vulnerabilities
It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to access arbitrary files, execute arbitrary …
first Mar 21, 2019 -
High max 7.8USN-3883-1 5 CVEs
libreoffice vulnerabilities
It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2018-10119, CVE-2018…
first Feb 6, 2019 -
High max 7.3USN-3871-1 13 CVEs
linux vulnerabilities
Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possi…
first Jan 29, 2019 -
High max 7.5USN-3855-1 3 CVEs
systemd vulnerabilities
It was discovered that systemd-journald allocated variable-length buffers for certain message fields on the stack. A local attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2018-16864) It was discovered that…
first Jan 11, 2019 -
High max 7.8USN-3849-1 8 CVEs
linux vulnerabilities
It was discovered that a NULL pointer dereference existed in the keyring subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-2647) It was discovered that a race condition existed in the raw MID…
first Dec 20, 2018 -
High max 7.8USN-3847-1 7 CVEs
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
It was discovered that a race condition existed in the raw MIDI driver for the Linux kernel, leading to a double free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-1090…
first Dec 20, 2018 -
High max 7.5USN-6128-1 1 CVE
cups vulnerability
It was discovered that CUPS incorrectly handled logging. A remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jun 1, 2023 -
High max 7.8USN-3816-1 3 CVEs
systemd vulnerabilities
Jann Horn discovered that unit_deserialize incorrectly handled status messages above a certain length. A local attacker could potentially exploit this via NotifyAccess to inject arbitrary state across re-execution and obtain root privileges. (CVE-2018-15686) …
first Nov 12, 2018 -
High max 8.0USN-3818-1 1 CVE
postgresql-10 vulnerability
It was discovered that PostgreSQL incorrectly handled certain trigger definitions when running pg_upgrade or pg_dump. A remote attacker could possibly use this issue to execute arbitrary SQL statements with superuser privileges.
first Nov 14, 2018 -
High max 7.8USN-3816-2 1 CVE
systemd vulnerability
USN-3816-1 fixed several vulnerabilities in systemd. However, the fix for CVE-2018-6954 was not sufficient. This update provides the remaining fixes. We apologize for the inconvenience. Original advisory details: Jann Horn discovered that unit_deserialize inc…
first Nov 19, 2018 -
High max 8.8USN-3807-1 1 CVE
network-manager vulnerability
Felix Wilhelm discovered that the NetworkManager internal DHCPv6 client incorrectly handled certain DHCPv6 messages. In non-default configurations where the internal DHCP client is enabled, an attacker on the same network could use this issue to cause Network…
first Nov 5, 2018 -
High max 8.8USN-3806-1 1 CVE
systemd vulnerability
Felix Wilhelm discovered that the systemd-networkd DHCPv6 client incorrectly handled certain DHCPv6 messages. In configurations where systemd-networkd is being used, an attacker on the same network could use this issue to cause systemd-networkd to crash, resu…
first Nov 5, 2018 -
High max 7.5USN-4230-2 1 CVE
clamav vulnerability
USN-4230-1 fixed a vulnerability in ClamAV. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that ClamAV incorrectly handled certain MIME messages. A remote attacker could po…
first Jan 23, 2020 -
High max 7.5USN-4230-1 1 CVE
clamav vulnerability
It was discovered that ClamAV incorrectly handled certain MIME messages. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service.
first Jan 8, 2020 -
High max 7.1USN-4219-1 1 CVE
libssh vulnerability
It was discovered that libssh incorrectly handled certain scp commands. If a user or automated system were tricked into using a specially-crafted scp command, a remote attacker could execute arbitrary commands on the server.
first Dec 10, 2019 -
High max 8.8
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass Content Security Policy (CSP)…
first Jan 9, 2020 -
High max 7.0USN-3777-1 7 CVEs
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
Jann Horn discovered that the vmacache subsystem did not properly handle sequence number overflows, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2018-171…
first Oct 1, 2018 -
High max 7.5USN-3769-1 1 CVE
bind9 vulnerability
It was discovered that Bind incorrectly handled the deny-answer-aliases feature. If this feature is enabled, a remote attacker could use this issue to cause Bind to crash, resulting in a denial of service.
first Sep 20, 2018 -
High max 8.5USN-3744-1 2 CVEs
postgresql-10, postgresql-9.3, postgresql-9.5 vulnerabilities
Andrew Krasichkov discovered that the PostgreSQL client library incorrectly reset its internal state between connections. A remote attacker could possibly use this issue to bypass certain client-side connection security features. This issue only affected Ubun…
first Aug 16, 2018