2,451 results · Clear filters · Feed
-
High max 7.5USN-4204-1 1 CVE
python-psutil vulnerability
Riccardo Schirone discovered that psutil incorrectly handled certain reference counting operations. An attacker could use this issue to cause psutil to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 28, 2019 -
High max 7.4USN-4196-1 2 CVEs
python-ecdsa vulnerabilities
It was discovered that python-ecdsa incorrectly handled certain signatures. A remote attacker could possibly use this issue to cause python-ecdsa to generate unexpected exceptions, resulting in a denial of service. (CVE-2019-14853) It was discovered that pyth…
first Nov 18, 2019 -
High max 7.0USN-4171-2 5 CVEs
apport vulnerabilities
USN-4171-1 fixed several vulnerabilities in apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Kevin Backhouse discovered Apport would read its user-controlled settings file as the root user. This could be u…
first Nov 4, 2019 -
High max 7.0USN-4171-1 5 CVEs
apport vulnerabilities
Kevin Backhouse discovered Apport would read its user-controlled settings file as the root user. This could be used by a local attacker to possibly crash Apport or have other unspecified consequences. (CVE-2019-11481) Sander Bos discovered a race-condition in…
first Oct 30, 2019 -
High max 7.5USN-4128-2 2 CVEs
tomcat9 vulnerabilities
It was discovered that the Tomcat 9 SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221) It was discovered that Tomcat 9 did not address HTTP/2 connection windo…
first Sep 18, 2019 -
High max 7.5USN-4128-1 2 CVEs
tomcat8 vulnerabilities
It was discovered that the Tomcat 8 SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221) It was discovered that Tomcat 8 did not address HTTP/2 connection windo…
first Sep 10, 2019 -
High max 7.5USN-4123-1 1 CVE
npm/fstream vulnerability
It was discovered that npm/fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write aritrary files to the filesystem.
first Sep 5, 2019 -
High max 7.5USN-4106-1 1 CVE
NLTK vulnerability
Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during extraction. A remote attacker could use this vulnerability to write arbitrary files to the filesystem
first Aug 20, 2019 -
High max 7.5USN-4099-1 3 CVEs
nginx vulnerabilities
Jonathan Looney discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to consume resources, leading to a denial of service.
first Aug 15, 2019 -
High max 7.2USN-4061-1 1 CVE
redis vulnerabilities
It was discovered that Redis incorrectly handled the hyperloglog data structure. An attacker could use this issue to cause Redis to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jul 16, 2019 -
High max 7.5USN-4022-1 1 CVE
Gunicorn vulnerability
It was discovered that gunicorn improperly handled certain input. An attacker could potentially use this issue execute a cross-site scripting (XSS) attack.
first Jun 19, 2019 -
High max 8.6USN-4011-2 2 CVEs
jinja2 vulnerabilities
USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possib…
first Jun 6, 2019 -
High max 8.6USN-4011-1 2 CVEs
jinja2 vulnerabilities
Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10745) Brian Welch discovered that Jinja incorrectly handled str.format_ma…
first Jun 6, 2019 -
High max 8.8USN-3935-1 10 CVEs
busybox vulnerabilities
Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could overwrite arbitrary files outside of the current director…
first Apr 3, 2019 -
High max 8.1USN-3924-1 2 CVEs
libapache2-mod-auth-mellon vulnerabilities
It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. (CVE-2019-3877) It was discovered that mod_auth_mellon incorrectly handled certain requests. An attac…
first Mar 28, 2019 -
High max 7.5USN-3890-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled formatting certain numbers. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.
first Feb 13, 2019 -
High max 7.0USN-3888-1 1 CVE
gvfs vulnerability
It was discovered that GVfs incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information.
first Feb 12, 2019 -
High max 8.8USN-3887-1 1 CVE
snapd vulnerability
Chris Moberly discovered that snapd versions 2.28 through 2.37 incorrectly validated and parsed the remote socket address when performing access controls on its UNIX socket. A local attacker could use this to access privileged socket APIs and obtain administr…
first Feb 12, 2019 -
High max 7.3USN-3871-5 13 CVEs
linux-azure vulnerabilities
Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possi…
first Feb 7, 2019 -
High max 7.3USN-3871-4 13 CVEs
linux-hwe, linux-aws-hwe, linux-gcp vulnerabilities
USN-3871-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Wen Xu discovered that a use-after-free vulner…
first Feb 4, 2019 -
High max 7.3USN-3871-3 13 CVEs
linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possi…
first Feb 4, 2019 -
High max 8.8USN-3857-1 1 CVE
php-pear vulnerability
Fariskhi Vidyan discovered that PEAR Archive_Tar incorrectly handled certain archive paths. A remote attacker could possibly use this issue to execute arbitrary code.
first Jan 14, 2019 -
High max 7.8USN-3847-3 7 CVEs
linux-azure vulnerabilities
USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux kernel for Microsoft Azure Cloud systems for Ubuntu 14.04 LTS. It was discovered that a race condition existed in the raw M…
first Dec 20, 2018 -
High max 7.8USN-3847-2 7 CVEs
linux-hwe, linux-aws-hwe, linux-azure, linux-gcp vulnerabilities
USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. It was discovered that a race condition existe…
first Dec 20, 2018 -
High max 8.1USN-3813-1 2 CVEs
pyopenssl vulnerabilities
It was discovered that pyOpenSSL incorrectly handled memory when handling X509 objects. A remote attacker could use this issue to cause pyOpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-1000807) It was discove…
first Nov 8, 2018 -
High max 8.2USN-3812-1 3 CVEs
nginx vulnerabilities
It was discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause excessive memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and …
first Nov 7, 2018 -
High max 8.8USN-3796-1 1 CVE
paramiko vulnerability
Daniel Hoffman discovered that Paramiko incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.
first Oct 17, 2018 -
High max 7.5USN-3780-1 1 CVE
haproxy vulnerability
It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service.
first Oct 2, 2018 -
High max 7.0USN-3777-2 7 CVEs
linux-hwe, linux-gcp vulnerabilities
USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Jann Horn discovered that the vmacache subsyst…
first Oct 1, 2018 -
High max 7.8USN-3776-2 9 CVEs
linux-lts-xenial, linux-aws vulnerabilities
USN-3776-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jann Horn discovered that the vmacache subsyst…
first Oct 1, 2018 -
High max 7.5USN-3771-1 4 CVEs
strongswan vulnerabilities
It was discovered that strongSwan incorrectly handled IKEv2 key derivation. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2018-10811) Sze Yiu Chau discovered that strongSwan incorrectly ha…
first Sep 25, 2018 -
High max 7.3USN-3753-2 11 CVEs
linux-lts-xenial, linux-aws vulnerabilities
USN-3753-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the generic SCSI driver…
first Aug 24, 2018 -
High max 8.3USN-3747-1 4 CVEs
openjdk-lts vulnerabilities
It was discovered that OpenJDK did not properly validate types in some situations. An attacker could use this to construct a Java class that could possibly bypass sandbox restrictions. (CVE-2018-2825, CVE-2018-2826) It was discovered that the PatternSyntaxExc…
first Aug 21, 2018 -
High max 7.5USN-3720-1 1 CVE
python-cryptography vulnerability
It was discovered that python-cryptography incorrectly handled certain inputs. An attacker could possibly use this to get access to sensitive information.
first Jul 23, 2018 -
High max 7.5USN-3616-1 1 CVE
python-crypto vulnerability
It was discovered that Python Crypto incorrectly generated ElGamal key parameters. A remote attacker could possibly use this issue to obtain sensitive information.
first Apr 3, 2018 -
High max 7.5USN-3573-1 3 CVEs
quagga vulnerabilities
It was discovered that a double-free vulnerability existed in the Quagga BGP daemon when processing certain forms of UPDATE message. A remote attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2018-5379) It was disco…
first Feb 16, 2018 -
High max 8.1USN-3520-1 1 CVE
python-pysaml2 vulnerability
It was discovered that PySAML2 incorrectly accepted any password when run with python optimizations enabled. An attacker could use this issue to authenticate as any user without a valid password.
first Jan 8, 2018 -
High max 8.8USN-3464-1 4 CVEs
wget vulnerabilities
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget incorrectly handled certain HTTP responses. A remote attacker could use this issue to cause Wget to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017…
first Oct 26, 2017 -
High max 7.5USN-3451-1 3 CVEs
swift vulnerabilities
It was discovered that OpenStack Swift incorrectly handled tempurls. A remote authenticated user in possession of a tempurl key authorized for PUT could retrieve other objects in the same Swift account. (CVE-2015-5223) Romain Le Disez and Örjan Persson discov…
first Oct 11, 2017 -
High max 7.5USN-3449-1 7 CVEs
nova vulnerabilities
George Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-3241) George Shuklin and Tushar Patil discovered that O…
first Oct 11, 2017