1,181 results · Clear filters · Feed
-
Medium max 4.2USN-7220-1 1 CVE
vim vulnerability
It was discovered that Vim incorrectly handled memory when closing buffers with the visual mode active. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first Jan 21, 2025 -
Medium max 5.3USN-7133-1 1 CVE
haproxy vulnerability
Yuki Mogi discovered that HAProxy incorrectly handled the interpretation of certain HTTP requests. A remote attacker could possibly use this issue to perform a request smuggling attack and obtain sensitive information.
first Dec 3, 2024 -
Medium max 5.5USN-7128-1 1 CVE
pygments vulnerability
Sebastian Chnelik discovered that Pygments had an inefficient regex query for analyzing certain inputs. An attacker could possibly use this issue to cause a denial of service.
first Nov 26, 2024 -
Medium max 5.3USN-7042-2 1 CVE
cups-browsed vulnerability
USN-7042-1 fixed a vulnerability in cups-browsed. This update improves the fix by removing support for the legacy CUPS printer discovery protocol entirely. Original advisory details: Simone Margaritelli discovered that cups-browsed could be used to create arb…
first Oct 9, 2024 -
Medium max 5.3USN-7042-1 1 CVE
cups-browsed vulnerability
Simone Margaritelli discovered that cups-browsed could be used to create arbitrary printers from outside the local network. In combination with issues in other printing components, a remote attacker could possibly use this issue to connect to a system, create…
first Sep 26, 2024 -
Medium max 6.0USN-6977-1 2 CVEs
qemu vulnerabilities
It was discovered that QEMU did not properly handle certain memory operations, which could result in a buffer overflow. An attacker could potentially use this issue to cause a denial of service. (CVE-2024-26327) It was discovered that QEMU did not properly ha…
first Aug 22, 2024 -
Medium max 6.5USN-6963-1 1 CVE
gnome-shell vulnerability
It was discovered that GNOME Shell incorrectly opened the portal helper automatically when detecting a captive network portal. A remote attacker could possibly use this issue to load arbitrary web pages containing JavaScript, leading to resource consumption o…
first Aug 15, 2024 -
Medium max 6.5USN-6959-1 1 CVE
dotnet8 vulnerability
It was discovered that .NET suffered from an information disclosure vulnerability. An attacker could potentially use this issue to read targeted email messages.
first Aug 13, 2024 -
Medium max 6.3USN-6940-1 3 CVEs
snapd vulnerabilities
Neil McPhail discovered that snapd did not properly restrict writes to the $HOME/bin path in the AppArmor profile for snaps using the home plug. An attacker who could convince a user to install a malicious snap could use this vulnerability to escape the snap …
first Aug 1, 2024 -
Medium max 6.2USN-6906-1 1 CVE
python-zipp vulnerability
It was discovered that python-zipp did not properly handle the zip files with malformed names. An attacker could possibly use this issue to cause a denial of service.
first Jul 24, 2024 -
Medium max 6.5USN-6800-1 1 CVE
node-browserify-sign vulnerability
It was discovered that browserify-sign incorrectly handled an upper bound check in signature verification. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a …
first May 30, 2024 -
Medium max 5.4USN-6792-1 1 CVE
flask-security vulnerability
Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs.
first May 28, 2024 -
Medium max 6.3USN-6773-1 2 CVEs
dotnet7, dotnet8 vulnerabilities
It was discovered that .NET did not properly handle memory in it's Double Parse routine. An attacker could possibly use this issue to achieve remote code execution. (CVE-2024-30045) It was discovered that .NET did not properly handle the usage of a shared res…
first May 16, 2024 -
Medium max 6.5USN-6769-1 2 CVEs
libspreadsheet-parsexlsx-perl vulnerabilities
Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. (CVE-2024-22368) An Pham …
first May 9, 2024 -
Medium max 4.9USN-6755-1 1 CVE
cpio vulnerabilities
Ingo Brückl discovered that cpio contained a path traversal vulnerability. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to write arbitrary files outside the target direc…
first Apr 29, 2024 -
Medium max 6.7USN-6744-3 1 CVE
pillow vulnerability
USN-6744-1 fixed a vulnerability in Pillow. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which c…
first Apr 29, 2024 -
Medium max 6.7USN-6744-2 1 CVE
pillow vulnerability
USN-6744-1 fixed a vulnerability in Pillow (Python 3). This update provides the corresponding updates for Pillow (Python 2) in Ubuntu 20.04 LTS. Original advisory details: Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when…
first Apr 22, 2024 -
Medium max 6.5USN-6691-1 1 CVE
ovn vulnerability
It was discovered that OVN incorrectly enabled OVS Bidirectional Forwarding Detection on logical ports. A remote attacker could possibly use this issue to disrupt traffic.
first Mar 12, 2024 -
Medium max 6.2USN-6679-1 1 CVE
frr vulnerability
It was discovered that FRR incorrectly handled certain malformed OSPF LSA packets. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service.
first Mar 6, 2024 -
Medium max 5.9USN-6595-1 1 CVE
pycryptodome vulnerability
It was discovered that PyCryptodome had a timing side-channel when performing OAEP decryption. A remote attacker could possibly use this issue to recover sensitive information.
first Jan 23, 2024 -
Medium max 5.3USN-6489-1 1 CVE
tang vulnerability
Brian McDermott discovered that Tang incorrectly handled permissions when creating/rotating keys. A local attacker could possibly use this issue to read the keys.
first Nov 20, 2023 -
Medium max 6.5USN-6362-2 1 CVE
.Net regressions
USN-6362-1 fixed vulnerabilities in .Net. It was discovered that the fix for [CVE-2023-36799](https://ubuntu.com/security/CVE-2023-36799) was incomplete. This update fixes the problem. Original advisory details: Kevin Jones discovered that .NET did not proper…
first Oct 25, 2023 -
Medium max 6.5USN-6362-1 1 CVE
dotnet6, dotnet7 vulnerability
Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service.
first Sep 12, 2023 -
Medium max 6.5USN-6241-1 1 CVE
cinder, ironic, nova, python-glance-store, python-os-brick vulnerability
Jan Wasilewski and Gorka Eguileor discovered that OpenStack incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes,…
first Jul 24, 2023 -
Medium max 6.1USN-6155-1 1 CVE
requests vulnerability
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly leaked Proxy-Authorization headers. A remote attacker could possibly use this issue to obtain sensitive information.
first Jun 12, 2023 -
Medium max 6.5USN-6073-4 1 CVE
python-os-brick vulnerability
Jan Wasilewski and Gorka Eguileor discovered that os-brick incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes t…
first May 11, 2023 -
Medium max 6.5USN-6073-3 1 CVE
nova vulnerability
Jan Wasilewski and Gorka Eguileor discovered that Nova incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes to be…
first May 11, 2023 -
Medium max 6.5USN-6073-2 1 CVE
python-glance-store vulnerability
Jan Wasilewski and Gorka Eguileor discovered that Glance_store incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration chang…
first May 11, 2023 -
Medium max 6.5USN-6073-1 1 CVE
cinder vulnerability
Jan Wasilewski and Gorka Eguileor discovered that Cinder incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes to …
first May 11, 2023 -
Medium max 5.5USN-6064-1 1 CVE
sqlparse vulnerability
It was discovered that SQL parse incorrectly handled certain regular expression. An attacker could possibly use this issue to cause a denial of service.
first May 10, 2023 -
Medium max 6.7USN-5966-3 3 CVEs
amanda regression
USN-5966-1 fixed vulnerabilities in amanda. Unfortunately that update caused a regression and was reverted in USN-5966-2. This update provides security fixes for Ubuntu 22.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. We apologize for the incon…
first Apr 3, 2023 -
Medium max 6.7USN-5966-1 3 CVEs
amanda vulnerabilities
Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information. (CVE-2022-377…
first Mar 23, 2023 -
Medium max 5.5USN-5871-2 1 CVE
git regression
USN-5871-1 fixed vulnerabilities in Git. A backport fixing part of the vulnerability in CVE-2023-22490 was required. This update fix this for Ubuntu 18.04 LTS. Original advisory details: It was discovered that Git incorrectly handled certain repositories. An …
first Mar 2, 2023 -
Medium max 6.5USN-5819-1 1 CVE
haproxy vulnerability
It was discovered that HAProxy incorrectly handled certain messages. A remote attacker could possibly use this issue to cause HAProxy to stop responding, resulting in a denial of service.
first Jan 23, 2023 -
Medium max 6.1USN-5698-1 1 CVE
openvswitch vulnerability
It was discovered that Open vSwitch incorrectly handled comparison of certain minimasks. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Oct 25, 2022 -
Medium max 5.7USN-5632-1 1 CVE
python-oauthlib vulnerability
Sebastian Chnelik discovered that OAuthLib incorrectly handled certain redirect uris. A remote attacker could possibly use this issue to cause OAuthLib to crash, resulting in a denial of service.
first Sep 22, 2022 -
Medium max 5.5USN-5612-1 1 CVE
intel-microcode vulnerability
Pietro Borrello, Andreas Kogler, Martin Schwarzl, Daniel Gruss, Michael Schwarz and Moritz Lipp discovered that some Intel processors did not properly clear data between subsequent xAPIC MMIO reads. This could allow a local attacker to compromise SGX enclaves.
first Sep 15, 2022 -
Medium max 6.5USN-5508-1 1 CVE
python-ldap vulnerability
It was discovered that Python LDAP incorrectly handled certain regular expressions. An remote attacker could possibly use this issue to cause a denial of service.
first Jul 11, 2022 -
Medium max 5.5USN-5496-1 1 CVE
cloud-init vulnerability
Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An attacker with access to these logs could potentially use this to gain user credentials.
first Jun 29, 2022 -
Medium max 4.4USN-5459-1 4 CVEs
cifs-utils vulnerabilities
Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-143…
first Jun 2, 2022