8,437 results · Feed
-
Critical max 10.0USN-7046-1 1 CVE
bubblewrap, flatpak vulnerability
It was discovered that Flatpak incorrectly handled certain persisted directories. An attacker could possibly use this issue to read and write files in locations it would not normally have access to. A patch was also needed to Bubblewrap in order to avoid race…
first Sep 30, 2024 -
Medium max 5.9USN-7051-1 1 CVE
python-asyncssh vulnerability
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to …
first Oct 2, 2024 -
High max 7.5USN-7057-1 1 CVE
ruby-webrick vulnerability
It was discovered that WEBrick incorrectly handled having both a Content- Length header and a Transfer-Encoding header. A remote attacker could possibly use this issue to perform a HTTP request smuggling attack.
first Oct 7, 2024 -
Medium max 5.4USN-7031-1 1 CVE
puma vulnerability
It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to overwrite header values set by intermediate proxies by providing duplicate headers containing underscore characters.
first Sep 24, 2024 -
Medium max 5.9USN-7024-1 1 CVE
tgt vulnerability
It was discovered that tgt attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.
first Sep 19, 2024 -
Medium max 5.3USN-7050-1 2 CVEs
ruby-devise-two-factor vulnerabilities
Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could possibly use this issue to intercept and re-use a one-time password. (CVE-2021-43177) Garrett Rappaport discovered that…
first Oct 1, 2024 -
Low max 3.9USN-7035-1 1 CVE
apparmor vulnerability
It was discovered that the AppArmor policy compiler incorrectly generated looser restrictions than expected for rules allowing mount operations. A local attacker could possibly use this to bypass AppArmor restrictions in applications where some mount operatio…
first Sep 25, 2024 -
Medium max 5.4USN-7031-2 1 CVE
puma vulnerability
USN-7031-1 fixed CVE-2024-45614 in Puma for Ubuntu 24.04 LTS. This update fixes the CVE for Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could poss…
first Sep 24, 2024 -
High max 7.5USN-7032-1 1 CVE
tomcat8, tomcat9 vulnerability
It was discovered that Tomcat incorrectly handled HTTP trailer headers. A remote attacker could possibly use this issue to perform HTTP request smuggling.
first Sep 24, 2024 -
Medium max 6.1USN-7011-1 2 CVEs
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20505) It was discovered that ClamAV incorrectly handled logfile privile…
first Sep 16, 2024 -
High max 8.7USN-7015-1 5 CVEs
python3.10, python3.12, python3.8 vulnerabilities
It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. (CVE-2023-27043) It was discovered that Python allowed …
first Sep 16, 2024 -
Medium max 6.5USN-7012-1 1 CVE
curl vulnerability
Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being checked properly, contrary to expectations.
first Sep 16, 2024 -
Critical max 9.8USN-7001-2 2 CVEs
libxmltok vulnerabilities
USN-7001-1 fixed vulnerabilities in xmltol library. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle certain func…
first Sep 17, 2024 -
Medium max 5.9USN-6991-1 1 CVE
python-aiohttp vulnerability
It was discovered that AIOHTTP did not properly restrict file access when the 'follow_symlinks' option was set to True. A remote attacker could possibly use this issue to access unauthorized files on the system.
first Sep 5, 2024 -
High max 7.5USN-7081-1 4 CVEs
golang-1.22 vulnerabilities
It was discovered that the Go net/http module did not properly handle responses to requests with an "Expect: 100-continue" header under certain circumstances. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-24791) It was disc…
first Oct 23, 2024 -
Critical max 9.8USN-7000-2 3 CVEs
expat vulnerabilities
USN-7000-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: Shang-Hung Wan discovered that Expat did not properly handle certain function calls when a negative input length was pro…
first Sep 17, 2024 -
Medium max 4.3USN-6989-1 1 CVE
ironic vulnerability
Dan Smith, Julia Kreger and Jay Faulkner discovered that in image processing for Ironic, a specially crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensiti…
first Sep 4, 2024 -
High max 7.5USN-6987-1 2 CVEs
python-django vulnerabilities
It was discovered that Django incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-45230) It was discovered that Django incorrectly handled certain email sending failures. A remote attacker coul…
first Sep 3, 2024 -
High max 7.5
netty vulnerabilities
It was discovered that Netty did not properly sanitize its input parameters. A remote attacker could possibly use this issue to cause a crash. (CVE-2023-34462) It was discovered that Netty incorrectly handled request cancellation. A remote attacker could poss…
first Sep 5, 2024 -
High max 7.5USN-6986-1 1 CVE
openssl vulnerability
David Benjamin discovered that OpenSSL incorrectly handled certain X.509 certificates. An attacker could possible use this issue to cause a denial of service or expose sensitive information.
first Sep 3, 2024 -
Medium max 6.1USN-6984-1 1 CVE
python-webob vulnerability
It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL.
first Sep 2, 2024 -
High max 7.5USN-7057-2 1 CVE
ruby-webrick vulnerability
USN-7057-1 fixed a vulnerability in WEBrick. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that WEBrick incorrectly handled having both a Content- Length header and a Transfer-Encoding header…
first Oct 8, 2024 -
Medium max 5.3USN-6960-1 1 CVE
ruby-rmagick vulnerability
Nick Browning discovered that RMagick incorrectly handled memory under certain operations. An attacker could possibly use this issue to cause a denial of service through memory exhaustion.
first Aug 14, 2024 -
Medium max 5.5USN-6961-1 4 CVEs
busybox vulnerabilities
It was discovered that BusyBox did not properly validate user input when performing certain arithmetic operations. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause a denial…
first Aug 14, 2024 -
Medium max 6.3USN-6944-1 1 CVE
curl vulnerability
Dov Murik discovered that curl incorrectly handled parsing ASN.1 Generalized Time fields. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive memory contents.
first Aug 5, 2024 -
High max 7.5USN-6941-1 1 CVE
python3.12 vulnerability
It was discovered that the Python ipaddress module contained incorrect information about which IP address ranges were considered “private” or “globally reachable”. This could possibly result in applications applying incorrect security policies.
first Aug 1, 2024 -
High max 7.4USN-6930-1 6 CVEs
openjdk-lts vulnerabilities
It was discovered that the Hotspot component of OpenJDK 11 was not properly bounding certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-2113…
first Jul 31, 2024 -
High max 7.4USN-6929-1 6 CVEs
openjdk-8 vulnerabilities
It was discovered that the Hotspot component of OpenJDK 8 was not properly bounding certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-21131…
first Jul 31, 2024 -
Medium max 6.5USN-6934-1 15 CVEs
mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.39 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. In addition to security fixes, the update…
first Jul 31, 2024 -
High max 7.4USN-6932-1 5 CVEs
openjdk-21 vulnerabilities
It was discovered that the Hotspot component of OpenJDK 21 was not properly bounding certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-2113…
first Jul 31, 2024 -
High max 7.5USN-6935-1 1 CVE
prometheus-alertmanager vulnerability
It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code. On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS,…
first Jul 31, 2024 -
High max 7.5USN-6928-1 2 CVEs
python3.10, python3.8 vulnerabilities
It was discovered that the Python ssl module contained a memory race condition when handling the APIs to obtain the CA certificates and certificate store statistics. This could possibly result in applications obtaining wrong results, leading to various SSL is…
first Jul 30, 2024 -
High max 7.4USN-6931-1 5 CVEs
openjdk-17 vulnerabilities
It was discovered that the Hotspot component of OpenJDK 17 was not properly bounding certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-2113…
first Jul 31, 2024 -
UnscoredUSN-6916-1 2 CVEs
lua5.4 vulnerabilities
It was discovered that Lua did not properly generate code when "_ENV" is constant. An attacker could possibly use this issue to cause a denial of service or execute arbitrary unstrusted lua code. (CVE-2022-28805) It was discovered that Lua did not properly ha…
first Jul 29, 2024 -
Medium max 6.5USN-6911-1 1 CVE
nova vulnerability
Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 23, 2024 -
Medium max 5.3USN-6902-1 1 CVE
apache2 vulnerability
It was discovered that the Apache HTTP Server incorrectly handled certain handlers configured via AddType. A remote attacker could possibly use this issue to obtain source code.
first Jul 18, 2024 -
High max 7.0USN-6899-1 1 CVE
gtk+2.0, gtk+3.0 vulnerability
It was discovered that GTK would attempt to load modules from the current directory, contrary to expectations. If users started GTK applications from shared directories, a local attacker could use this issue to execute arbitrary code, and possibly escalate pr…
first Jul 16, 2024 -
High max 7.5USN-6909-2 2 CVEs
bind9 vulnerabilities
USN-6909-1 fixed several vulnerabilities in Bind. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Toshifumi Sakaguchi discovered that Bind incorrectly handled having a very large number of RRs existing at the sam…
first Aug 1, 2024 -
High max 7.5USN-6888-2 4 CVEs
python-django vulnerabilities
USN-6888-1 fixed several vulnerabilities in Django. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Elias Myllymäki discovered that Django incorrectly handled certain inputs with a large number of brackets. A rem…
first Jul 11, 2024 -
Medium max 6.5USN-6882-2 2 CVEs
cinder regression
USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to incorrect privilege handling. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Martin Kaesberger discovered …
first Nov 7, 2024