2,451 results · Clear filters · Feed
-
High max 7.6USN-4960-1 1 CVE
runc vulnerability
Etienne Champetier discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount the host filesystem into the container and escalate privileges.
first May 19, 2021 -
High max 7.5USN-4932-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwrite files in unexpected directories.
first May 4, 2021 -
High max 7.5USN-4885-1 1 CVE
pygments vulnerability
It was discovered that Pygments incorrectly handled parsing SML files. If a user or automated system were tricked into parsing a specially crafted SML file, a remote attacker could cause Pygments to hang, resulting in a denial of service.
first Mar 22, 2021 -
High max 7.8USN-4871-1 2 CVEs
targetcli-fb vulnerabilities
It was discovered that targetcli-fb did not properly manage socket permissions. A local attacker could use this issue to modify the iSCSI configuration resulting in a denial of service, obtain sensitive information or execute arbitrary code. (CVE-2020-10699) …
first Mar 15, 2021 -
High max 7.0USN-4870-1 1 CVE
bundler vulnerability
It was discovered that Bundler incorrectly created directories with insecure permissions in /tmp. An attacker could write malicious libraries to this location for later execution.
first Mar 15, 2021 -
High max 7.8USN-4840-1 2 CVEs
singularity-container vulnerabilities
It was discovered that Singularity incorrectly handled certain inputs. An attacker could possibly use this issue to obtain sensitive information. (CVE-2018-19295) It was discovered that Singularity incorrectly handled access control. An attacker could possibl…
first Mar 15, 2021 -
High max 8.0USN-4761-1 1 CVE
git vulnerability
Matheus Tavares discovered that Git incorrectly handled delay-capable clean/smudge filters when being used on case-insensitive filesystems. A remote attacker could possibly use this issue to execute arbitrary code.
first Mar 9, 2021 -
High max 7.5USN-4757-2 1 CVE
wpa vulnerability
USN-4757-1 fixed a vulnerability in wpa_supplicant and hostapd. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that wpa_supplicant did not properly handle P2P (Wi-Fi Direct) provision discovery…
first Mar 4, 2021 -
High max 7.5USN-4757-1 1 CVE
wpa vulnerability
It was discovered that wpa_supplicant did not properly handle P2P (Wi-Fi Direct) provision discovery requests in some situations. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code.
first Mar 3, 2021 -
High max 7.5USN-4729-1 1 CVE
openvswitch vulnerability
Joakim Hindersson discovered that Open vSwitch incorrectly parsed certain network packets. A remote attacker could use this issue to cause a denial of service, or possibly alter packet classification.
first Feb 10, 2021 -
High max 7.5
php-pear vulnerability
It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute arbitrary code.
first Feb 8, 2021 -
High max 8.8USN-4720-2 3 CVEs
apport vulnerabilities
USN-4720-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Itai Greenhut discovered that Apport incorrectly parsed certain files in the /proc filesystem. A local attacker …
first Feb 3, 2021 -
High max 8.8USN-4720-1 3 CVEs
apport vulnerabilities
Itai Greenhut discovered that Apport incorrectly parsed certain files in the /proc filesystem. A local attacker could use this issue to escalate privileges and run arbitrary code. (CVE-2021-25682, CVE-2021-25683) Itai Greenhut discovered that Apport incorrect…
first Feb 2, 2021 -
High max 8.0USN-4714-1 3 CVEs
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. (CVE-2020-26217) It was discovered that XStream was vulnerable to server-side …
first Jan 28, 2021 -
High max 7.8
sudo vulnerability
USN-4705-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker c…
first Jan 27, 2021 -
High max 7.2USN-4690-1 1 CVE
coturn vulnerability
It was discovered that coTURN allowed peers to connect and relay packets to loopback addresses in the range of 127.x.x.x. A malicious user could use this vulnerability to insert packages into the loopback interface.
first Jan 11, 2021 -
High max 7.5USN-4655-1 2 CVEs
python-werkzeug vulnerabilities
It was discovered that Werkzeug has insufficient debugger PIN randomness. An attacker could use this issue to access sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-14806) It was discovered that Werkzeug incorrectly handled certain…
first Dec 1, 2020 -
High max 7.8
php-pear vulnerabilities
It was discovered that PEAR incorrectly sanitized filenames. A remote attacker could possibly use this issue to execute arbitrary code.
first Dec 1, 2020 -
High max 8.8USN-4629-1 2 CVEs
moin vulnerabilities
Michael Chapman discovered that MoinMoin incorrectly handled certain cache actions. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-25074) Catarina Leite discovered that MoinMoin incorrectly handled certain SVG files. An attacke…
first Nov 11, 2020 -
High max 8.8USN-4618-1 1 CVE
tmux vulnerability
Sergey Nizovtsev discovered that tmux incorrectly handled some inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
first Nov 5, 2020 -
High max 7.1USN-4605-1 1 CVE
blueman vulnerability
Vaisha Bernard discovered that blueman did not properly sanitize input on the d-bus interface to blueman-mechanism. A local attacker could possibly use this issue to escalate privileges and run arbitrary code or cause a denial of service. (CVE-2020-15238)
first Oct 27, 2020 -
High max 8.1USN-4597-1 3 CVEs
libapache2-mod-auth-mellon vulnerabilities
François Kooman discovered that mod_auth_mellon incorrectly handled cookies. An attacker could possibly use this issue to cause a Cross-Site Session Transfer attack. (CVE-2017-6807) It was discovered that mod_auth_mellon incorrectly handled certain requests. …
first Oct 22, 2020 -
High max 7.1USN-4595-1 1 CVE
grunt vulnerability
It was discovered that Grunt did not properly load yaml files. An attacker could possibly use this to execute arbitrary code. (CVE-2020-7729)
first Oct 20, 2020 -
High max 8.6USN-4561-2 2 CVEs
ruby-rack vulnerabilities
USN-4561-1 fixed vulnerabilities in Rack. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10. Original advisory details: It was discovered that Rack incorrectly handled certain paths. An attacker could possib…
first Apr 6, 2021 -
High max 8.6USN-4561-1 2 CVEs
ruby-rack vulnerabilities
It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-8161) It was discovered that Rack incorrectly validated cookies. An attacker could possibly use this issue to f…
first Sep 30, 2020 -
High max 7.5USN-4505-1 1 CVE
libphp-phpmailer vulnerability
Elar Lang discovered that PHPMailer did not properly escape double quote characters in filenames. A remote attacker could possibly exploit this with a crafted filename to bypass attachment filters that are based on matching filename extensions. (CVE-2020-1362…
first Sep 16, 2020 -
High max 8.2USN-4502-1 1 CVE
ruby-websocket-extensions vulnerability
It was discovered that websocket-extensions does not properly parse special headers. A remote attacker could use this issue to cause regex backtracking, resulting in a denial of service. (CVE-2020-7663)
first Sep 16, 2020 -
High max 7.5USN-4479-1 2 CVEs
python-django vulnerabilities
It was discovered that Django, when used with Python 3.7 or higher, incorrectly handled directory permissions. A local attacker could possibly use this issue to obtain sensitive information, or escalate permissions.
first Sep 1, 2020 -
High max 7.5USN-4478-1 1 CVE
python-rsa vulnerability
It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issue to obtain sensitive information.
first Aug 31, 2020 -
High max 8.6USN-4477-1 3 CVEs
squid vulnerabilities
Amit Klein discovered that Squid incorrectly validated certain data. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. (CVE-2020-15810) Régis Leroy discovered that Squid incorrectly vali…
first Aug 27, 2020 -
High max 8.3USN-4453-1 8 CVEs
openjdk-8 vulnerabilities
Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control contexts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-14556) Philippe Arteau discovered that OpenJDK 8 incorrectly verified names in TLS server's X.5…
first Aug 5, 2020 -
High max 7.0USN-4449-2 3 CVEs
apport vulnerabilities
USN-4449-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that Apport incorrectly dropped privilege…
first Sep 2, 2020 -
High max 7.0USN-4449-1 3 CVEs
apport vulnerabilities
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that Apport incorrectly dropped privileges when making certain D-Bus calls. A local attacker could use this issue to read arbitrary files. (CVE-2020-11936) Seong-Joong Kim discovered that …
first Aug 4, 2020 -
High max 8.3USN-4433-1 8 CVEs
openjdk-lts vulnerabilities
Johannes Kuhn discovered that OpenJDK incorrectly handled access control contexts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-14556) It was discovered that OpenJDK incorrectly handled memory allocation when reading TIFF ima…
first Jul 23, 2020 -
High max 7.0USN-4415-1 3 CVEs
coturn vulnerabilities
Felix Dörre discovered that coTURN response buffer is not initialized properly. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-4067) It was discovered that coTURN web server incorrectly handled HTTP POST requests. An atta…
first Jul 6, 2020 -
High max 8.3USN-4337-1 13 CVEs
openjdk-8, openjdk-lts vulnerabilities
It was discovered that OpenJDK incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted regular expression. (CVE-2020-2754, CVE-2020-2755) It was discovered th…
first Apr 22, 2020 -
High max 7.8USN-4313-1 1 CVE
linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerability
Manfred Paul discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use this to expose sensitive information (kernel memory) or gain administrative privileges.
first Mar 30, 2020 -
High max 7.5USN-4297-1 2 CVEs
runc vulnerabilities
It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount over the /proc directory and escalate privileges. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-16884) It was discovered th…
first Mar 9, 2020 -
High max 8.8USN-4296-1 1 CVE
python-django vulnerability
Norbert Szetei discovered that Django incorrectly handled the GIS functions and aggregates on Oracle. A remote attacker could possibly use this issue to perform an SQL injection attack.
first Mar 4, 2020 -
High max 7.5USN-4245-1 1 CVE
python-pysaml2 vulnerability
It was discovered that PySAML2 incorrectly handled certain SAML files. An attacker could possibly use this issue to bypass signature verification with arbitrary data.
first Jan 21, 2020