8,437 results · Feed
-
UnscoredUSN-7140-2 1 CVE
tinyproxy vulnerability
USN-7140-1 fixed CVE-2022-40468 in tinyproxy. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: It was discovered that Tinyproxy did not properly manage memory under certain circumstances. An attacker could possibl…
first Jan 6, 2025 -
Critical max 9.8USN-7134-1 11 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Dec 3, 2024 -
High max 8.8USN-7132-1 4 CVEs
postgresql-12, postgresql-14, postgresql-16 vulnerabilities
It was discovered that PostgreSQL incorrectly tracked tables with row security. A remote attacker could possibly use this issue to perform forbidden reads and modifications. (CVE-2024-10976) Jacob Champion discovered that PostgreSQL clients used untrusted ser…
first Dec 2, 2024 -
High max 7.5USN-7127-1 3 CVEs
libsoup3 vulnerabilities
It was discovered that libsoup ignored certain characters at the end of header names. A remote attacker could possibly use this issue to perform a HTTP request smuggling attack. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-52530) …
first Nov 27, 2024 -
High max 7.5USN-7150-1 2 CVEs
python-tornado vulnerabilities
It was discovered that Tornado incorrectly handled a certain redirect. A remote attacker could possibly use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having the user access a specially crafted URL. This issue was …
first Dec 11, 2024 -
High max 8.0USN-7130-1 1 CVE
gh vulnerability
It was discovered that GitHub CLI incorrectly handled username validation. An attacker could possibly use this issue to perform remote code execution if the user connected to a malicious server. (CVE-2024-52308)
first Nov 26, 2024 -
High max 8.1USN-7111-1 14 CVEs
golang-1.17 vulnerabilities
Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-41723) Marten Seemann discovered that Go did not properly manage memory under certain circumstanc…
first Nov 14, 2024 -
Medium max 6.8USN-7108-2 2 CVEs
python-asyncssh vulnerabilities
USN-7108-1 fixed vulnerabilities in AysncSSH. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info …
first Dec 12, 2024 -
Medium max 5.9USN-7101-1 1 CVE
pydantic vulnerability
It was discovered that Pydantic incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause a denial of service via a crafted email string.
first Nov 12, 2024 -
Medium max 6.5USN-7102-1 16 CVEs
mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.40 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. In addition to security fix…
first Nov 12, 2024 -
Medium max 5.3USN-7116-1 1 CVE
python3.10, python3.12, python3.8 vulnerability
It was discovered that Python incorrectly handled quoting path names when using the venv module. A local attacker able to control virtual environments could possibly use this issue to execute arbitrary code when the virtual environment is activated.
first Nov 19, 2024 -
Medium max 6.9USN-7093-1 1 CVE
python-werkzeug vulnerability
It was discovered that Werkzeug incorrectly handled multiple form submission requests. A remote attacker could possibly use this issue to cause Werkzeug to consume resources, leading to a denial of service.
first Nov 5, 2024 -
Medium max 6.7USN-7092-2 1 CVE
mpg123 vulnerability
USN-7092-1 fixed a vulnerability in mpg123. Bastien Roucariès discovered that the fix was incomplete on Ubuntu 20.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that mpg123 incorrectly h…
first Nov 27, 2024 -
Critical max 9.1USN-7115-1 2 CVEs
Waitress vulnerabilities
It was discovered that Waitress could process follow up requests when receiving a specially crafted message. An attacker could use this issue to have the server process inconsistent client requests. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. …
first Nov 19, 2024 -
High max 7.4USN-7098-1 9 CVEs
openjdk-17 vulnerabilities
Andy Boothe discovered that the Networking component of OpenJDK 17 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208) It was discovered that the …
first Nov 11, 2024 -
High max 7.4USN-7097-1 10 CVEs
openjdk-lts vulnerabilities
Andy Boothe discovered that the Networking component of OpenJDK 11 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208) It was discovered that the …
first Nov 11, 2024 -
Medium max 6.8USN-7108-1 2 CVEs
python-asyncssh vulnerabilities
Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that AsyncSSH did not properly handle the extension info message. An attacker able to intercept communications could possibly use this issue to downgrade the algorithm used for client authentication…
first Nov 18, 2024 -
High max 8.6USN-7174-1 1 CVE
gstreamer1.0 vulnerability
Antonio Morales discovered that GStreamer incorrectly handled allocating memory for certain buffers. An attacker could use this issue to cause GStreamer to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Dec 18, 2024 -
Medium max 6.3USN-7106-1 5 CVEs
tomcat9 vulnerabilities
It was discovered that Tomcat did not include the secure attribute for session cookies when using the RemoteIpFilter with requests from a reverse proxy. An attacker could possibly use this issue to leak sensitive information. (CVE-2023-28708) It was discovere…
first Nov 13, 2024 -
Medium max 6.7USN-7092-1 1 CVE
mpg123 vulnerability
It was discovered that mpg123 incorrectly handled certain mp3 files. If a user or automated system were tricked into opening a specially crafted mp3 file, a remote attacker could use this issue to cause mpg123 to crash, resulting in a denial of service, or po…
first Nov 5, 2024 -
Medium max 4.8USN-7099-1 4 CVEs
openjdk-21 vulnerabilities
Andy Boothe discovered that the Networking component of OpenJDK 21 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208) It was discovered that the …
first Nov 10, 2024 -
High max 7.5USN-6982-1 2 CVEs
dovecot vulnerabilities
It was discovered that Dovecot did not not properly have restrictions on ithe size of address headers. A remote attacker could possibly use this issue to cause denial of service. (CVE-2024-23184, CVE-2024-23185)
first Sep 2, 2024 -
Critical max 9.8
apache2 vulnerabilities
Marc Stern discovered that the Apache HTTP Server incorrectly handled serving WebSocket protocol upgrades over HTTP/2 connections. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2024-36387)…
first Jul 8, 2024 -
Critical max 9.8USN-6946-1 4 CVEs
python-django vulnerabilities
It was discovered that Django incorrectly handled certain strings in floatformat function. An attacker could possibly use this issue to cause a memory exhaustion. (CVE-2024-41989) It was discovered that Django incorrectly handled very large inputs. An attacke…
first Aug 6, 2024 -
High max 7.5USN-7013-1 2 CVEs
dovecot vulnerabilities
It was discovered that Dovecot incorrectly handled a large number of address headers. A remote attacker could possibly use this issue to cause Dovecot to consume resources, leading to a denial of service. (CVE-2024-23184) It was discovered that Dovecot incorr…
first Sep 16, 2024 -
Critical max 9.8USN-6992-1 8 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Sep 5, 2024 -
High max 8.8USN-6847-1 8 CVEs
libheif vulnerabilities
It was discovered that libheif incorrectly handled certain image data. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-11471) Reza Mirzazade Farkhani discov…
first Jun 25, 2024 -
High max 7.8USN-6807-1 15 CVEs
frr vulnerabilities
It was discovered that FRR incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2022-26126, CVE-2022-26127, CVE-2022-26128, CVE-2022-26129, CVE-2022-37032, C…
first Jun 5, 2024 -
Critical max 9.8USN-6995-1 10 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass secu…
first Sep 9, 2024 -
High max 8.8USN-6835-1 5 CVEs
ghostscript vulnerabilities
It was discovered that Ghostscript did not properly restrict eexec seeds to those specified by the Type 1 Font Format standard when SAFER mode is used. An attacker could use this issue to bypass SAFER restrictions and cause unspecified impact. (CVE-2023-52722…
first Jun 17, 2024 -
High max 7.5USN-6909-1 4 CVEs
bind9 vulnerabilities
It was discovered that Bind incorrectly handled a flood of DNS messages over TCP. A remote attacker could possibly use this issue to cause Bind to become unstable, resulting in a denial of service. (CVE-2024-0760) Toshifumi Sakaguchi discovered that Bind inco…
first Jul 23, 2024 -
Critical max 9.8USN-7086-1 11 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Oct 31, 2024 -
High max 7.8USN-7085-1 1 CVE
xorg-server, xwayland vulnerability
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain memory operations in the X Keyboard Extension. An attacker could use this issue to cause the X Server to crash, leading to a denial of service, or possibly execute arbitrary code.
first Oct 30, 2024 -
Medium max 6.5USN-7078-1 1 CVE
firefox vulnerability
Atte Kettunen discovered that Firefox did not properly validate before inserting ranges into the selection node cache. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first Oct 22, 2024 -
High max 7.5
haproxy vulnerability
It was discovered that HAProxy did not properly limit the creation of new HTTP/2 streams. A remote attacker could possibly use this issue to cause HAProxy to consume excessive resources, leading to a denial of service.
first Oct 14, 2024 -
High max 8.4USN-7062-1 2 CVEs
libgsf vulnerabilities
It was discovered that libgsf incorrectly handled certain Compound Document Binary files. If a user or automated system were tricked into opening a specially crafted file, a remote attacker could possibly use this issue to execute arbitrary code.
first Oct 10, 2024 -
High max 7.1USN-7059-1 1 CVE
oath-toolkit vulnerability
Fabian Vogt discovered that OATH Toolkit incorrectly handled file permissions. A remote attacker could possibly use this issue to overwrite root owned files, leading to a privilege escalation attack. (CVE-2024-47191)
first Oct 9, 2024 -
Critical max 9.8USN-7056-1 11 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Oct 7, 2024 -
Critical max 9.0USN-7055-1 1 CVE
freeradius vulnerability
Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl discovered that FreeRADIUS incorrectly authenticated certain responses. An attacker able to intercept communications between a RADIUS client and server could possibly …
first Oct 3, 2024 -
Critical max 9.8USN-7061-1 11 CVEs
golang-1.17 vulnerabilities
Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531) Sohom Datta discovered that Go did not properly validate backticks (`) as…
first Oct 10, 2024