8,437 results · Feed
-
High max 7.8LSN-0097-1 7 CVEs
Kernel Live Patch Security Notice
It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly …
first Sep 5, 2023 -
High max 7.8LSN-0096-1 5 CVEs
Kernel Live Patch Security Notice
It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could c…
first Jul 25, 2023 -
High max 8.8LSN-0091-1 2 CVEs
Kernel Live Patch Security Notice
It was discovered that a race condition existed in the memory address space accounting implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execu…
first Feb 14, 2023 -
High max 8.6
Kernel Live Patch Security Notice
It was discovered that a race condition existed in the network scheduling subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.…
first Jun 2, 2022 -
High max 7.8
Kernel Live Patch Security Notice
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges.(CVE-2022-0492) Nick Gregory dis…
first Mar 23, 2022 -
Medium max 5.5USN-3679-1 1 CVE
qemu update
Ken Johnson and Jann Horn independently discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via sidechannel attacks. An attacker in the guest could use this to expose sensitive guest information…
first Jun 12, 2018 -
High max 8.4
Kernel Live Patch Security Notice
William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system c…
first Jan 20, 2022 -
High max 8.3
Kernel Live Patch Security Notice
The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.…
first Jan 6, 2022 -
High max 7.8LSN-0082-1 4 CVEs
Kernel Live Patch Security Notice
Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensi…
first Nov 11, 2021 -
High max 8.3
Kernel Live Patch Security Notice
Maxim Levitsky discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel did not properly prevent a guest VM from enabling AVIC in nested guest VMs. An attacker in a guest VM could use this to write to portions of the host's phy…
first Sep 13, 2021 -
Medium max 5.5USN-3652-1 1 CVE
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem vulnerability
Jann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A local attacker could use this to expose sensiti…
first May 22, 2018 -
Medium max 5.5USN-3651-1 1 CVE
qemu update
Ken Johnson and Jann Horn independently discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via sidechannel attacks. An attacker in the guest could use this to expose sensitive guest information…
first May 21, 2018 -
High max 8.3
Kernel Live Patch Security Notice
Andy Nguyen discovered that the netfilter subsystem in the Linux kernel contained an out-of-bounds write in its setsockopt() implementation. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-20…
first Aug 16, 2021 -
High max 7.8LSN-0079-1 2 CVEs
Kernel Live Patch Security Notice
It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.(CVE-2021-3600) It was…
first Jul 26, 2021 -
UnscoredLSN-0078-1 1 CVE
Kernel Live Patch Security Notice
Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute arbitrary code.(CVE-2021-3609)
first Jul 19, 2021 -
High max 8.8LSN-0077-1 1 CVE
Kernel Live Patch Security Notice
Vincent Dehors discovered that the shiftfs file system in the Ubuntu Linux kernel did not properly handle faults in copy_from_user() when passing through ioctls to an underlying file system. A local attacker could use this to cause a denial of service (memory…
first May 17, 2021 -
High max 8.8
Kernel Live Patch Security Notice
It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges.(CVE-2021-3493) Piotr Kr…
first May 3, 2021 -
Medium max 6.7LSN-0072-1 7 CVEs
Kernel Live Patch Security Notice
It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-0067) It …
first Oct 14, 2020 -
Medium max 6.7LSN-0071-1 1 CVE
Kernel Live Patch Security Notice
Or Cohen discovered that the AF_PACKET implementation in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14…
first Sep 10, 2020 -
Medium max 4.4LSN-0070-1 1 CVE
Kernel Live Patch Security Notice
Mauricio Faria de Oliveira discovered that the aufs implementation in the Linux kernel improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service. (CVE-2020-11935)
first Aug 17, 2020 -
UnscoredLSN-0069-1 3 CVEs
Kernel Live Patch Security Notice
Relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result. (CVE-2019-19462) Fan Yang discovered that the mremap implementation in the Linux …
first Jul 27, 2020 -
UnscoredLSN-0067-1 1 CVE
Kernel Live Patch Security Notice
It was discovered that the Serial CAN interface driver in the Linux kernel did not properly initialize data. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-11494)
first May 20, 2020 -
UnscoredLSN-0066-1 3 CVEs
Kernel Live Patch Security Notice
It was discovered that the virtual terminal implementation in the Linux kernel did not properly handle resize events. A local attacker could use this to expose sensitive information. (CVE-2020-8647) It was discovered that the virtual terminal implementation i…
first May 1, 2020 -
High max 7.7USN-8372-1 1 CVE
age vulnerability
It was discovered that age did not properly validate plugin names. An attacker could possibly use this issue to cause execution of an arbitrary program by supplying a crafted recipient or identity string.
-
High max 8.6USN-8238-2 1 CVE
editorconfig-core vulnerability
USN-8238-1 fixed a vulnerability in EditorConfig. This update contains the corresponding fix for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Original advisory details: It was discovered that EditorConfig incorrectly handled spe…
-
Critical max 9.3USN-8366-1 2 CVEs
luanti vulnerabilities
It was discovered that Luanti, when using LuaJIT, did not properly enforce Lua sandbox restrictions. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-40959) It was discovered that Luanti did not properly restrict access to insecu…
-
Medium max 5.9USN-8369-1 1 CVE
libapache-mod-jk vulnerability
It was discovered that Apache Tomcat Connectors used incorrect default permissions for shared memory on Unix-like systems. A local attacker could possibly use this issue to view or modify mod_jk configuration data in shared memory, resulting in sensitive info…
-
High max 8.7USN-8367-1 3 CVEs
node-tar-fs vulnerabilities
It was discovered that tar-fs did not properly limit paths when extracting crafted tar files. An attacker could possibly use this issue to write or overwrite files outside the intended extraction directory. This issue only affected Ubuntu 22.04 LTS and Ubuntu…
-
Low max 3.3USN-8368-1 1 CVE
libeconf vulnerability
It was discovered that libeconf did not properly check the size of input when copying data to a buffer. An attacker could possibly use this issue to cause libeconf to crash, resulting in a denial of service.
-
Medium max 5.3USN-8364-1 1 CVE
libcommons-lang-java, libcommons-lang3-java vulnerability
It was discovered that Apache Commons Lang incorrectly handled recursion in the ClassUtils.getClass method. An attacker could possibly use this issue to cause Apache Commons Lang to crash, resulting in a denial of service.
-
Medium max 6.5USN-8363-1 25 CVEs
mysql-8.0, mysql-8.4 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.46 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. Ubuntu 25.10 and Ubuntu 26.04 LTS have been updated to MySQL…
-
Low max 1.7USN-8362-1 1 CVE
xz-utils vulnerability
It was discovered that XZ Utils did not properly manage memory when attempting to append data to a decoded index that contained no records. An attacker could possibly use this issue to cause XZ Utils to crash, resulting in a denial of service, or execute arbi…
-
Medium max 4.0USN-8209-2 1 CVE
lcms2 vulnerability
USN-8209-1 fixed vulnerabilities in Little CMS. This update contains the fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Little CMS incorrectly handled certain malformed I…
-
Critical max 9.3USN-8360-1 1 CVE
sslh vulnerability
It was discovered that sslh did not properly handle symbolic links when writing its PID file. A local attacker could possibly use this issue to overwrite arbitrary files.
-
Medium max 6.4USN-8359-1 1 CVE
nncp vulnerability
It was discovered that NNCP did not properly sanitize file paths in packet data during file requesting and file saving operations. A remote attacker could possibly use this issue to read or write arbitrary files outside of the intended directory.
-
High max 7.8USN-8358-1 1 CVE
haveged vulnerability
It was discovered that haveged incorrectly handled credential checks on its control socket. A local attacker could possibly use this issue to execute privileged commands.
-
High max 7.5USN-8356-1 1 CVE
gsasl vulnerability
It was discovered that GNU SASL did not properly handle certain DIGEST-MD5 tokens. An attacker could possibly use this issue to cause GNU SASL to crash, resulting in a denial of service.
-
Medium max 5.5USN-8355-1 1 CVE
sssd vulnerability
It was discovered that SSSD did not properly handle raw bytes in the PAM passkey responder. A local attacker could possibly use this issue to cause the SSSD PAM responder to crash, resulting in a denial of service.
-
Medium max 5.3USN-8353-1 1 CVE
exim4 vulnerability
Warisjeet Singh discovered that Exim with SUPPORT_PROXY enabled did not properly handle memory before SMTP authentication. A remote attacker could possibly use this issue to obtain sensitive information.
-
Medium max 5.4USN-8352-1 1 CVE
libreoffice vulnerability
Duc Anh Nguyen discovered that LibreOffice incorrectly handled mismatched encryption salt parameters in crafted OOXML documents. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary co…