1,181 results · Clear filters · Feed
-
Medium max 6.1USN-7193-1 1 CVE
thunderbird vulnerability
Masato Kinugawa discovered that Thunderbird did not properly validate the CSP policy in the Web Compatibility extension. An attacker could potentially exploit this issue to perform a cross-site scripting attack.
first Jan 9, 2025 -
Medium max 5.8USN-7205-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain IPv6 strings. An attacker could possibly use this issue to cause a denial of service.
first Jan 14, 2025 -
Medium max 6.8USN-7108-2 2 CVEs
python-asyncssh vulnerabilities
USN-7108-1 fixed vulnerabilities in AysncSSH. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info …
first Dec 12, 2024 -
Medium max 5.9USN-7101-1 1 CVE
pydantic vulnerability
It was discovered that Pydantic incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause a denial of service via a crafted email string.
first Nov 12, 2024 -
Medium max 6.5USN-7102-1 16 CVEs
mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.40 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. In addition to security fix…
first Nov 12, 2024 -
Medium max 5.3USN-7116-1 1 CVE
python3.10, python3.12, python3.8 vulnerability
It was discovered that Python incorrectly handled quoting path names when using the venv module. A local attacker able to control virtual environments could possibly use this issue to execute arbitrary code when the virtual environment is activated.
first Nov 19, 2024 -
Medium max 6.9USN-7093-1 1 CVE
python-werkzeug vulnerability
It was discovered that Werkzeug incorrectly handled multiple form submission requests. A remote attacker could possibly use this issue to cause Werkzeug to consume resources, leading to a denial of service.
first Nov 5, 2024 -
Medium max 6.7USN-7092-2 1 CVE
mpg123 vulnerability
USN-7092-1 fixed a vulnerability in mpg123. Bastien Roucariès discovered that the fix was incomplete on Ubuntu 20.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that mpg123 incorrectly h…
first Nov 27, 2024 -
Medium max 6.8USN-7108-1 2 CVEs
python-asyncssh vulnerabilities
Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept communications could possibly use this issue to downgrade the algorithm used for client authentication…
first Nov 18, 2024 -
Medium max 6.3USN-7106-1 5 CVEs
tomcat9 vulnerabilities
It was discovered that Tomcat did not include the secure attribute for session cookies when using the RemoteIpFilter with requests from a reverse proxy. An attacker could possibly use this issue to leak sensitive information. (CVE-2023-28708) It was discovere…
first Nov 13, 2024 -
Medium max 6.7USN-7092-1 1 CVE
mpg123 vulnerability
It was discovered that mpg123 incorrectly handled certain mp3 files. If a user or automated system were tricked into opening a specially crafted mp3 file, a remote attacker could use this issue to cause mpg123 to crash, resulting in a denial of service, or po…
first Nov 5, 2024 -
Medium max 4.8USN-7099-1 4 CVEs
openjdk-21 vulnerabilities
Andy Boothe discovered that the Networking component of OpenJDK 21 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208) It was discovered that the …
first Nov 10, 2024 -
Medium max 6.5USN-7078-1 1 CVE
firefox vulnerability
Atte Kettunen discovered that Firefox did not properly validate before inserting ranges into the selection node cache. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first Oct 22, 2024 -
Medium max 5.9USN-7051-1 1 CVE
python-asyncssh vulnerability
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to …
first Oct 2, 2024 -
Medium max 5.4USN-7031-1 1 CVE
puma vulnerability
It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to overwrite header values set by intermediate proxies by providing duplicate headers containing underscore characters.
first Sep 24, 2024 -
Medium max 5.9USN-7024-1 1 CVE
tgt vulnerability
It was discovered that tgt attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.
first Sep 19, 2024 -
Medium max 5.3USN-7050-1 2 CVEs
ruby-devise-two-factor vulnerabilities
Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could possibly use this issue to intercept and re-use a one-time password. (CVE-2021-43177) Garrett Rappaport discovered that…
first Oct 1, 2024 -
Medium max 5.4USN-7031-2 1 CVE
puma vulnerability
USN-7031-1 fixed CVE-2024-45614 in Puma for Ubuntu 24.04 LTS. This update fixes the CVE for Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could poss…
first Sep 24, 2024 -
Medium max 6.1USN-7011-1 2 CVEs
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20505) It was discovered that ClamAV incorrectly handled logfile privile…
first Sep 16, 2024 -
Medium max 6.5USN-7012-1 1 CVE
curl vulnerability
Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being checked properly, contrary to expectations.
first Sep 16, 2024 -
Medium max 5.9USN-6991-1 1 CVE
python-aiohttp vulnerability
It was discovered that AIOHTTP did not properly restrict file access when the 'follow_symlinks' option was set to True. A remote attacker could possibly use this issue to access unauthorized files on the system.
first Sep 5, 2024 -
Medium max 4.3USN-6989-1 1 CVE
ironic vulnerability
Dan Smith, Julia Kreger and Jay Faulkner discovered that in image processing for Ironic, a specially crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensiti…
first Sep 4, 2024 -
Medium max 6.1USN-6984-1 1 CVE
python-webob vulnerability
It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL.
first Sep 2, 2024 -
Medium max 5.3USN-6960-1 1 CVE
ruby-rmagick vulnerability
Nick Browning discovered that RMagick incorrectly handled memory under certain operations. An attacker could possibly use this issue to cause a denial of service through memory exhaustion.
first Aug 14, 2024 -
Medium max 5.5USN-6961-1 4 CVEs
busybox vulnerabilities
It was discovered that BusyBox did not properly validate user input when performing certain arithmetic operations. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause a denial…
first Aug 14, 2024 -
Medium max 6.3USN-6944-1 1 CVE
curl vulnerability
Dov Murik discovered that curl incorrectly handled parsing ASN.1 Generalized Time fields. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive memory contents.
first Aug 5, 2024 -
Medium max 6.5USN-6934-1 15 CVEs
mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.39 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. In addition to security fixes, the update…
first Jul 31, 2024 -
Medium max 6.5USN-6911-1 1 CVE
nova vulnerability
Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 23, 2024 -
Medium max 5.3USN-6902-1 1 CVE
apache2 vulnerability
It was discovered that the Apache HTTP Server incorrectly handled certain handlers configured via AddType. A remote attacker could possibly use this issue to obtain source code.
first Jul 18, 2024 -
Medium max 6.5USN-6882-2 2 CVEs
cinder regression
USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to incorrect privilege handling. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Martin Kaesberger discovered …
first Nov 7, 2024 -
Medium max 6.5USN-6883-1 1 CVE
glance vulnerability
Martin Kaesberger discovered that Glance incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 8, 2024 -
Medium max 6.5USN-6884-1 1 CVE
nova vulnerability
Martin Kaesberger discovered that Nova incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 8, 2024 -
Medium max 6.5USN-6882-1 1 CVE
cinder vulnerability
Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 8, 2024 -
Medium max 6.5USN-6851-1 1 CVE
netplan.io vulnerabilities
Andreas Hasenack discovered that netplan incorrectly handled the permissions for netdev files containing wireguard configuration. An attacker could use this to obtain wireguard secret keys. It was discovered that netplan configuration could be manipulated int…
first Jun 26, 2024 -
Medium max 6.5USN-6757-2 3 CVEs
php7.4, php8.1, php8.2 vulnerabilities
USN-6757-1 fixed vulnerabilities in PHP. Unfortunately these fixes were incomplete for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. This update fixes the problem. Original advisory details: It was discovered that PHP incorrectly handled PHP_CLI_SERVE…
first May 2, 2024 -
Medium max 5.9USN-6560-1 2 CVEs
openssh vulnerabilities
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to …
first Dec 19, 2023 -
Medium max 5.9USN-6539-1 2 CVEs
python-cryptography vulnerabilities
It was discovered that the python-cryptography Cipher.update_into function would incorrectly accept objects with immutable buffers. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, a…
first Dec 6, 2023 -
Medium max 4.9USN-6839-1 1 CVE
mariadb, mariadb-10.6 vulnerability
A security issue was discovered in MariaDB and this update includes new upstream MariaDB versions to fix the issue. MariaDB has been updated to 10.6.18 in Ubuntu 22.04 LTS and to 10.11.8 in Ubuntu 23.10 and Ubuntu 24.04 LTS. In addition to security fixes, the…
first Jun 19, 2024 -
Medium max 6.5USN-6600-1 2 CVEs
mariadb, mariadb-10.3, mariadb-10.6 vulnerabilities
Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.39 in Ubuntu 20.04 LTS, 10.6.16 in Ubuntu 22.04 LTS and 10.11.6 in Ubuntu 23.10. CVE-2022-47015 onl…
first Jan 25, 2024 -
Medium max 5.3USN-6823-1 14 CVEs
mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.37 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10, and Ubuntu 24.04 LTS. In addition to security fix…
first Jun 11, 2024