2,451 results · Clear filters · Feed
-
High max 7.8USN-3776-1 9 CVEs
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Jann Horn discovered that the vmacache subsystem did not properly handle sequence number overflows, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2018-171…
first Oct 1, 2018 -
High max 7.8
linux vulnerabilities
It was discovered that the paravirtualization implementation in the Linux kernel did not properly handle some indirect calls, reducing the effectiveness of Spectre v2 mitigations for paravirtual guests. A local attacker could use this to expose sensitive info…
first Oct 1, 2018 -
High max 7.5USN-3765-1 1 CVE
curl vulnerability
It was discovered that curl incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code.
first Sep 17, 2018 -
High max 7.3USN-3753-1 11 CVEs
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the generic SCSI driver in the Linux kernel did not properly enforce permissions on kernel memory access. A local attacker could use this to expose sensitive information or possibly elevate privileges. (CVE-2017-13168) Wen Xu discovered…
first Aug 24, 2018 -
High max 7.5USN-3739-1 5 CVEs
libxml2 vulnerabilities
Matias Brutti discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2016-9318) It was discovered that libxml2 incorrectly handled certain files. An attacker could possibl…
first Aug 14, 2018 -
High max 8.8USN-3687-1 7 CVEs
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …
first Jun 18, 2018 -
High max 7.3USN-3658-1 5 CVEs
procps vulnerabilities
It was discovered that the procps-ng top utility incorrectly read its configuration file from the current working directory. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-1122) It was discovered that the procps-ng ps tool in…
first May 23, 2018 -
High max 8.0USN-3641-1 3 CVEs
linux, linux-aws, linux-azure, linux-euclid, linux-gcp, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem, linux-raspi2, linux-snapdragon vulnerabilities
Nick Peterson discovered that the Linux kernel did not properly handle debug exceptions following a MOV/POP to SS instruction. A local attacker could use this to cause a denial of service (system crash). This issue only affected the amd64 architecture. (CVE-2…
first May 8, 2018 -
High max 8.8USN-3645-1 24 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cro…
first May 11, 2018 -
High max 7.5USN-3586-1 4 CVEs
isc-dhcp vulnerabilities
Konstantin Orekhov discovered that the DHCP server incorrectly handled a large number of concurrent TCP sessions. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CV…
first Mar 1, 2018 -
High max 7.5USN-4435-1 3 CVEs
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled parsing ARJ archives. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2020-3327) It was discovered that ClamAV incorrectly handled scanning mali…
first Jul 27, 2020 -
High max 7.5USN-3535-1 1 CVE
bind9 vulnerability
Jayachandran Palanisamy discovered that the Bind resolver incorrectly handled fetch cleanup sequencing. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
first Jan 17, 2018 -
High max 7.5USN-3504-1 1 CVE
libxml2 vulnerability
Wei Lei discovered that libxml2 incorrecty handled certain parameter entities. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.
first Dec 5, 2017 -
High max 8.8USN-3528-1 4 CVEs
ruby1.9.1, ruby2.3 vulnerabilities
It was discovered that Ruby incorrectly handled certain terminal emulator escape sequences. An attacker could use this to execute arbitrary code via a crafted user name. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-10784) It was disco…
first Jan 10, 2018 -
High max 8.8USN-3513-1 1 CVE
libxml2 vulnerability
It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.
first Dec 13, 2017 -
High max 7.8USN-3474-1 1 CVE
liblouis vulnerability
Raphael Sanchez Prudencio discovered that Liblouis incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a denial of service or potentially execute arbitrary code.
first Nov 6, 2017 -
High max 8.8USN-3462-1 2 CVEs
pacemaker vulnerabilities
Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled the IPC interface. A local attacker could possibly use this issue to execute arbitrary code with root privileges. (CVE-2016-7035) Alain Moulle discovered that Pacemaker incorrectly han…
first Oct 24, 2017 -
High max 7.4USN-3426-1 3 CVEs
samba vulnerabilities
Stefan Metzmacher discovered that Samba incorrectly enforced SMB signing in certain situations. A remote attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2017-12150) Stefan Metzmacher discovered that Samba incorrectly handled encr…
first Sep 21, 2017 -
High max 8.8USN-3380-1 8 CVEs
freerdp vulnerabilities
It was discovered that FreeRDP incorrectly handled certain width and height values. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.0…
first Aug 7, 2017 -
High max 8.8USN-3418-1 3 CVEs
gdk-pixbuf vulnerabilities
It was discovered that the GDK-PixBuf library did not properly handle certain jpeg images. If an user or automated system were tricked into opening a specially crafted jpeg file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in…
first Sep 18, 2017 -
High max 7.1USN-3381-1 4 CVEs
linux vulnerabilities
Peter Pi discovered that the colormap handling for frame buffer devices in the Linux kernel contained an integer overflow. A local attacker could use this to disclose sensitive information (kernel memory). (CVE-2016-8405) It was discovered that the Linux kern…
first Aug 7, 2017 -
High max 7.1USN-3378-1 4 CVEs
linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities
Fan Wu and Shixiong Zhao discovered a race condition between inotify events and vfs rename operations in the Linux kernel. An unprivileged local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2017-7533) It …
first Aug 3, 2017 -
High max 7.0USN-3360-1 15 CVEs
linux vulnerabilities
It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2014-9900) It was discovered that the Linux kernel did not properly restri…
first Jul 21, 2017 -
High max 8.8USN-3350-1 7 CVEs
poppler vulnerabilities
Aleksandar Nikolic discovered that poppler incorrectly handled JPEG 2000 images. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the …
first Jul 7, 2017 -
High max 7.5USN-3346-1 2 CVEs
bind9 vulnerabilities
Clément Berthaux discovered that Bind did not correctly check TSIG authentication for zone update requests. An attacker could use this to improperly perform zone updates. (CVE-2017-3143) Clément Berthaux discovered that Bind did not correctly check TSIG authe…
first Jun 29, 2017 -
High max 7.8USN-3295-1 11 CVEs
jasper vulnerabilities
It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …
first May 18, 2017 -
High max 7.8
ghostscript vulnerabilities
It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby allowing the execution of arbitrary code, or cause…
first Apr 28, 2017 -
High max 8.8USN-3271-1 6 CVEs
libxslt vulnerabilities
Holger Fuhrmannek discovered an integer overflow in the xsltAddTextString() function in Libxslt. An attacker could use this to craft a malicious document that, when opened, could cause a denial of service (application crash) or possible execute arbitrary code…
first Apr 28, 2017 -
High max 7.5USN-3259-1 3 CVEs
bind9 vulnerabilities
It was discovered that the resolver in Bind made incorrect assumptions about ordering when processing responses containing a CNAME or DNAME. An attacker could use this cause a denial of service. (CVE-2017-3137) Oleg Gorokhov discovered that in some situations…
first Apr 17, 2017 -
High max 8.8
oxide-qt vulnerabilities
Multiple vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, spoof application UI by causing the security status API or web…
first Mar 29, 2017 -
High max 7.5USN-3231-1 1 CVE
pidgin vulnerability
Joseph Bisch discovered that Pidgin incorrectly handled certain xml messages. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 14, 2017 -
High max 7.5USN-3202-1 2 CVEs
spice vulnerabilities
Frediano Ziglio discovered that Spice incorrectly handled certain client messages. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Feb 20, 2017 -
High max 7.5USN-3201-1 1 CVE
bind9 vulnerabilities
It was discovered that Bind incorrectly handled rewriting certain query responses when using both DNS64 and RPZ. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
first Feb 16, 2017 -
High max 7.5USN-3222-1 10 CVEs
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …
first Mar 8, 2017 -
High max 7.8USN-3182-1 1 CVE
ntfs-3g vulnerability
Jann Horn discovered that NTFS-3G incorrectly filtered environment variables when using the modprobe utility. A local attacker could possibly use this issue to load arbitrary kernel modules.
first Feb 1, 2017 -
High max 8.8
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …
first Jan 10, 2017 -
High max 8.1USN-3158-1 3 CVEs
samba vulnerabilities
Frederic Besler and others discovered that the ndr_pull_dnsp_nam function in Samba contained an integer overflow. An authenticated attacker could use this to gain administrative privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubun…
first Dec 19, 2016 -
High max 7.5
thunderbird vulnerabilities
Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong, Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially …
first Dec 1, 2016 -
High max 7.5
firefox vulnerabilities
It was discovered that data: URLs can inherit the wrong origin after a HTTP redirect in some circumstances. An attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-9078) A use-after-free was discovered in SVG animations. If a …
first Nov 30, 2016 -
High max 7.0
linux vulnerability
It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges.
first Oct 20, 2016