8,437 results · Feed
-
Medium max 5.3USN-6078-1 1 CVE
libwebp vulnerability
Irvan Kurniawan discovered that libwebp incorrectly handled certain memory operations. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a den…
first May 16, 2023 -
Critical max 9.8USN-6059-1 1 CVE
erlang vulnerability
It was discovered that Erlang did not properly implement TLS client certificate validation during the TLS handshake. A remote attacker could use this issue to bypass client authentication.
first May 8, 2023 -
High max 8.8USN-6012-1 1 CVE
smarty3 vulnerability
It was discovered that Smarty incorrectly parsed blocks' names and included files' names. A remote attacker with template writing permissions could use this issue to execute arbitrary PHP code. (CVE-2022-29221)
first Apr 13, 2023 -
Critical max 9.1USN-6036-1 1 CVE
patchelf vulnerability
It was discovered that PatchELF was not properly performing bounds checks, which could lead to an out-of-bounds read via a specially crafted file. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-…
first Apr 20, 2023 -
High max 7.5USN-5999-1 1 CVE
node-trim-newlines vulnerability
It was discovered that trim-newlines incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2021-33623)
first Apr 5, 2023 -
UnscoredUSN-6005-1 2 CVEs
sudo vulnerabilities
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly escaped control characters in log messages and sudoreplay output. An attacker could possibly use these issues to inject terminal control characters that alter output when being viewed.
first Apr 11, 2023 -
High max 7.8USN-5986-1 1 CVE
xorg-server, xorg-server-hwe-18.04, xwayland vulnerability
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain memory operations. An attacker could possibly use these issues to cause the X Server to crash, execute arbitrary code, or escalate privileges.
first Mar 29, 2023 -
High max 7.7USN-5992-1 1 CVE
ldb vulnerability
Demi Marie Obenour discovered that ldb, when used with Samba, incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive information.
first Apr 3, 2023 -
UnscoredUSN-5965-1 1 CVE
tigervnc vulnerability
It was discovered that TigerVNC mishandled TLS certificate exceptions. An attacker could use this vulnerability to impersonate any server after a client had added an exception and obtain sensitive information.
first Mar 21, 2023 -
Critical max 9.8USN-5931-1 1 CVE
python3.8 vulnerability
It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2022-37454)
first Mar 7, 2023 -
Critical max 9.8USN-5930-1 1 CVE
python3.7 vulnerability
It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2022-37454)
first Mar 7, 2023 -
High max 7.7USN-5902-1 3 CVEs
php7.2, php7.4, php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly allow applications to accept any password as valid, contrary to expectations. (CVE-2023-0567) It was discovered that PHP incorrect…
first Feb 28, 2023 -
High max 7.5USN-5868-1 1 CVE
python-django vulnerability
Jakob Ackermann discovered that Django incorrectly handled certain file uploads. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.
first Feb 14, 2023 -
High max 8.6USN-5907-1 1 CVE
c-ares vulnerability
It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could use this issue to cause c-ares to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 2, 2023 -
High max 7.7USN-5993-1 2 CVEs
samba vulnerabilities
Demi Marie Obenour discovered that the Samba LDAP server incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive information. (CVE-2023-0614) Andrew Bartlett discover…
first Apr 3, 2023 -
UnscoredUSN-5890-1 2 CVEs
openvswitch vulnerabilities
Qian Chen discovered that Open vSwitch incorrectly handled certain Organization Specific TLVs. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Feb 27, 2023 -
Medium max 6.5USN-5855-2 2 CVEs
imagemagick vulnerabilities
USN-5855-1 fixed a vulnerability in ImageMagick. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. Original advisory details: It was discovered that ImageMagick incorrectly handled certain PNG images. If a…
first Mar 15, 2023 -
Critical max 9.8USN-5822-1 7 CVEs
samba vulnerabilities
It was discovered that Samba incorrectly handled the bad password count logic. A remote attacker could possibly use this issue to bypass bad passwords lockouts. This issue was only addressed in Ubuntu 22.10. (CVE-2021-20251) Evgeny Legerov discovered that Sam…
first Jan 24, 2023 -
High max 7.5USN-5710-1 3 CVEs
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled certain X.509 Email Addresses. If a certificate authority were tricked into signing a specially-crafted certificate, a remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a d…
first Nov 1, 2022 -
High max 8.8USN-5782-1 7 CVEs
firefox vulnerabilities
It was discovered that Firefox was using an out-of-date libusrsctp library. An attacker could possibly use this library to perform a reentrancy issue on Firefox. (CVE-2022-46871) Nika Layzell discovered that Firefox was not performing a check on paste receive…
first Dec 15, 2022 -
High max 7.5USN-5776-1 4 CVEs
containerd vulnerabilities
It was discovered that containerd incorrectly handled memory when receiving certain faulty Exec or ExecSync commands. A remote attacker could possibly use this issue to cause a denial of service or crash containerd. (CVE-2022-23471, CVE-2022-31030) It was dis…
first Dec 13, 2022 -
High max 7.5USN-5739-1 36 CVEs
mariadb-10.3, mariadb-10.6 vulnerabilities
Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security…
first Nov 23, 2022 -
Critical max 9.8USN-5726-1 19 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the contents of the addressbar, bypass security restrictions,…
first Nov 16, 2022 -
UnscoredUSN-5631-1 4 CVEs
libjpeg-turbo vulnerabilities
It was discovered that libjpeg-turbo incorrectly handled certain EOF characters. An attacker could possibly use this issue to cause libjpeg-turbo to consume resource, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11813) …
first Sep 22, 2022 -
Medium max 4.4USN-5736-2 17 CVEs
imagemagick vulnerabilities
USN-5736-1 fixed vulnerabilities in ImageMagick. This update provides the corresponding updates for Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. One of the issues, CVE-2021-20224, only affected Ubuntu 20.04 ESM, while CVE-2021-20245, CVE-2021-3574, CVE-2021-4219 an…
first Nov 24, 2022 -
Medium max 5.9USN-5734-1 8 CVEs
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain data lenghts. A malicious server could use this issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.…
first Nov 22, 2022 -
UnscoredUSN-5685-1 2 CVEs
frr vulnerabilities
It was discovered that FRR incorrectly handled parsing certain BGP messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2022-37032) It was discovered that FRR incorrectly handled processing ce…
first Oct 18, 2022 -
High max 7.8USN-5760-1 3 CVEs
libxml2 vulnerabilities
It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash. (CVE-2022-2309) It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue t…
first Dec 5, 2022 -
UnscoredUSN-5617-1 20 CVEs
xen vulnerabilities
It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processo…
first Sep 19, 2022 -
High max 7.5USN-5585-1 8 CVEs
jupyter-notebook vulnerabilities
It was discovered that Jupyter Notebook incorrectly handled certain notebooks. An attacker could possibly use this issue of lack of Content Security Policy in Nbconvert to perform cross-site scripting (XSS) attacks on the notebook server. This issue only affe…
first Aug 30, 2022 -
Critical max 9.8USN-5823-1 20 CVEs
mysql-5.7, mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.32 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. Ubuntu 18.04 LTS has been updated to MySQL 5.…
first Jan 24, 2023 -
High max 7.8USN-5811-1 2 CVEs
sudo vulnerabilities
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly handled user-specified editors when using the sudoedit command. A local attacker that has permission to use the sudoedit command could possibly use this issue to edit arbitrary files. (CVE-…
first Jan 18, 2023 -
High max 8.8USN-5724-1 15 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass Content Security Policy (CSP) or o…
first Nov 11, 2022 -
Critical max 9.8USN-5717-1 4 CVEs
php7.2, php7.4, php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain gzip files. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-31628) It was discovered that PHP incorrectly handled certain cookies. An attacker could possibly use this iss…
first Nov 8, 2022 -
High max 8.8USN-5663-1 12 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, spoof the mouse pointer position, obtain …
first Oct 7, 2022 -
High max 7.5USN-5626-1 6 CVEs
bind9 vulnerabilities
Yehuda Afek, Anat Bremler-Barr, and Shani Stajnrod discovered that Bind incorrectly handled large delegations. A remote attacker could possibly use this issue to reduce performance, leading to a denial of service. (CVE-2022-2795) It was discovered that Bind i…
first Sep 21, 2022 -
UnscoredUSN-5620-1 7 CVEs
openexr vulnerabilities
It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. These issues only affect…
first Sep 20, 2022 -
High max 7.5USN-5873-1 5 CVEs
golang-golang-x-text, golang-x-text vulnerabilities
It was discovered that Go Text incorrectly handled certain encodings. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14040) It was discovered that Go Text incor…
first Feb 16, 2023 -
Medium max 6.5USN-5855-1 2 CVEs
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain PNG images. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause ImageMagick to stop responding, resulting in a denial of…
first Feb 9, 2023 -
Medium max 5.3USN-5897-1 2 CVEs
openjdk-17, openjdk-19, openjdk-lts vulnerabilities
Juraj Somorovsky, Marcel Maehren, Nurullah Erinola, and Robert Merget discovered that the DTLS implementation in the JSSE subsystem of OpenJDK did not properly restrict handshake initiation requests from clients. A remote attacker could possibly use this to c…
first Feb 28, 2023