8,437 results · Feed
-
Medium max 6.5USN-6883-1 1 CVE
glance vulnerability
Martin Kaesberger discovered that Glance incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 8, 2024 -
High max 7.5USN-6888-1 4 CVEs
python-django vulnerabilities
Elias Myllymäki discovered that Django incorrectly handled certain inputs with a large number of brackets. A remote attacker could possibly use this issue to cause Django to consume resources or stop responding, resulting in a denial of service. (CVE-2024-388…
first Jul 9, 2024 -
Medium max 6.5USN-6884-1 1 CVE
nova vulnerability
Martin Kaesberger discovered that Nova incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 8, 2024 -
Critical max 9.8USN-6886-1 9 CVEs
golang-1.21, golang-1.22 vulnerabilities
It was discovered that the Go net/http module did not properly handle the requests when request\'s headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 i…
first Jul 9, 2024 -
Medium max 6.5USN-6882-1 1 CVE
cinder vulnerability
Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
first Jul 8, 2024 -
High max 7.5USN-6880-1 1 CVE
Tomcat vulnerability
Sam Shahsavar discovered that Apache Tomcat did not properly reject HTTP requests with an invalid Content-Length header. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks.
first Jul 9, 2024 -
UnscoredUSN-6854-1 1 CVE
openssl vulnerability
It was discovered that OpenSSL failed to choose an appropriately short private key size when computing shared-secrets in the Diffie-Hellman Key Agreement Protocol. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, resultin…
first Jun 27, 2024 -
High max 7.3USN-6843-1 1 CVE
plasma-workspace vulnerability
Fabian Vogt discovered that Plasma Workspace incorrectly handled connections via ICE. A local attacker could possibly use this issue to gain access to another user's session manager and execute arbitrary code.
first Jun 26, 2024 -
Medium max 6.5USN-6851-1 1 CVE
netplan.io vulnerabilities
Andreas Hasenack discovered that netplan incorrectly handled the permissions for netdev files containing wireguard configuration. An attacker could use this to obtain wireguard secret keys. It was discovered that netplan configuration could be manipulated int…
first Jun 26, 2024 -
Critical max 9.8USN-6759-1 5 CVEs
freerdp3 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a remote attacker could possibly use this issue to cause FreeRDP to crash, resulting in a denial of service.
first Apr 29, 2024 -
High max 8.6USN-6718-1 2 CVEs
curl vulnerabilities
Dan Fandrich discovered that curl would incorrectly use the default set of protocols when a parameter option disabled all protocols without adding any, contrary to expectations. This issue only affected Ubuntu 23.10. (CVE-2024-2004) It was discovered that cur…
first Mar 27, 2024 -
High max 8.1
Go vulnerabilities
Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross site scripting attack. This issue only a…
first Jan 11, 2024 -
Medium max 6.5USN-6757-2 3 CVEs
php7.4, php8.1, php8.2 vulnerabilities
USN-6757-1 fixed vulnerabilities in PHP. Unfortunately these fixes were incomplete for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. This update fixes the problem. Original advisory details: It was discovered that PHP incorrectly handled PHP_CLI_SERVE…
first May 2, 2024 -
Critical max 9.8USN-6736-2 4 CVEs
klibc vulnerabilities
USN-6736-1 fixed vulnerabilities in klibc. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: It was discovered that zlib, vendored in klibc, incorrectly handled pointer arithmetic. An attacker could use this issue…
first May 23, 2024 -
High max 7.5USN-6644-2 3 CVEs
tiff vulnerabilities
USN-6644-1 fixed vulnerabilities in LibTIFF. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that LibTIFF incorrectly handled certain files. If a user were tricked into opening a specially craf…
first Feb 27, 2024 -
High max 7.3USN-6566-1 2 CVEs
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled certain protection mechanisms when using a CLI script with the --safe option, contrary to expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908) It was discovered that SQLite incorrectly han…
first Jan 3, 2024 -
High max 7.5USN-6564-1 5 CVEs
nodejs vulnerabilities
Hubert Kario discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. (CVE-2022-4304…
first Jan 3, 2024 -
Medium max 5.9USN-6560-1 2 CVEs
openssh vulnerabilities
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to …
first Dec 19, 2023 -
Medium max 5.9USN-6539-1 2 CVEs
python-cryptography vulnerabilities
It was discovered that the python-cryptography Cipher.update_into function would incorrectly accept objects with immutable buffers. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, a…
first Dec 6, 2023 -
High max 7.5USN-6642-1 5 CVEs
bind9 vulnerabilities
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023…
first Feb 19, 2024 -
High max 7.5USN-6593-1 2 CVEs
gnutls28 vulnerabilities
It was discovered that GnuTLS had a timing side-channel when processing malformed ciphertexts in RSA-PSK ClientKeyExchange. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2024-0553) It was discovered that GnuTLS incorre…
first Jan 22, 2024 -
High max 8.6USN-6728-1 5 CVEs
squid vulnerabilities
Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-…
first Apr 10, 2024 -
High max 8.8USN-6717-1 9 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass secu…
first Mar 26, 2024 -
Critical max 9.1USN-6682-1 6 CVEs
puma vulnerabilities
ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-11076) It was discovered that Puma in…
first Mar 7, 2024 -
High max 7.5USN-6633-1 5 CVEs
bind9 vulnerabilities
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023…
first Feb 13, 2024 -
High max 7.5USN-6567-1 11 CVEs
qemu vulnerabilities
Gaoning Pan and Xingwei Li discovered that QEMU incorrectly handled the USB xHCI controller device. A privileged guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS and…
first Jan 8, 2024 -
Medium max 4.9USN-6839-1 1 CVE
mariadb, mariadb-10.6 vulnerability
A security issue was discovered in MariaDB and this update includes new upstream MariaDB versions to fix the issue. MariaDB has been updated to 10.6.18 in Ubuntu 22.04 LTS and to 10.11.8 in Ubuntu 23.10 and Ubuntu 24.04 LTS. In addition to security fixes, the…
first Jun 19, 2024 -
Critical max 9.8USN-6703-1 11 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Mar 20, 2024 -
High max 7.5USN-6690-1 2 CVEs
openvswitch vulnerabilities
Timothy Redaelli and Haresh Khandelwal discovered that Open vSwitch incorrectly handled certain crafted Geneve packets when hardware offloading via the netlink path is enabled. A remote attacker could possibly use this issue to cause Open vSwitch to crash, le…
first Mar 12, 2024 -
Medium max 6.5USN-6600-1 2 CVEs
mariadb, mariadb-10.3, mariadb-10.6 vulnerabilities
Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.39 in Ubuntu 20.04 LTS, 10.6.16 in Ubuntu 22.04 LTS and 10.11.6 in Ubuntu 23.10. CVE-2022-47015 onl…
first Jan 25, 2024 -
High max 8.6USN-6718-3 2 CVEs
curl vulnerabilities
USN-6718-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Dan Fandrich discovered that curl would incorrectly use the default set of protocols when a parameter option disabled all…
first Apr 29, 2024 -
High max 7.5USN-6672-1 3 CVEs
nodejs vulnerabilities
Morgan Jones discovered that Node.js incorrectly handled certain inputs that leads to false positive errors during some cryptographic operations. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker coul…
first Mar 4, 2024 -
High max 7.5USN-6657-1 3 CVEs
dnsmasq vulnerabilities
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Dnsmasq icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE…
first Feb 26, 2024 -
Critical max 9.1USN-6852-1 1 CVE
wget vulnerability
It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote attacker could possibly trick a user into connecting to a different host than expected.
first Jun 26, 2024 -
UnscoredUSN-6829-1 1 CVE
libmatio vulnerability
It was discovered that matio incorrectly handled certain malformed files. An attacker could possibly use this issue to cause a denial of service.
first Jun 13, 2024 -
Critical max 9.8USN-6853-1 1 CVE
ruby2.7, ruby3.0, ruby3.1 vulnerability
It was discovered that Ruby incorrectly handled the ungetbyte and ungetc methods. A remote attacker could use this issue to cause Ruby to crash, resulting in a denial of service, or possibly obtain sensitive information.
first Jun 26, 2024 -
Medium max 5.3USN-6823-1 14 CVEs
mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.37 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.10, and Ubuntu 24.04 LTS. In addition to security fix…
first Jun 11, 2024 -
High max 7.1USN-6836-1 1 CVE
sssd vulnerability
It was discovered that SSSD did not always correctly apply the GPO policy for authenticated users, contrary to expectations. This could result in improper authorization or improper access to resources.
first Jun 17, 2024 -
Medium max 4.4USN-6833-1 1 CVE
vte2.91 vulnerability
Siddharth Dushantha discovered that VTE incorrectly handled large window resize escape sequences. An attacker could possibly use this issue to consume resources, leading to a denial of service.
first Jun 13, 2024 -
Medium max 6.6USN-6838-1 2 CVEs
ruby2.7, ruby3.0, ruby3.1, ruby3.2 vulnerabilities
It was discovered that Ruby RDoc incorrectly parsed certain YAML files. If a user or automated system were tricked into parsing a specially crafted .rdoc_options file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2024-27281)…
first Jun 17, 2024