8,437 results · Feed
-
UnscoredUSN-4636-1 1 CVE
libvncserver, vino vulnerability
It was discovered that LibVNCServer incorrectly handled certain internals. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Vino package ships with a LibV…
first Nov 17, 2020 -
UnscoredUSN-4631-1 1 CVE
libmaxminddb vulnerability
It was discovered that libmaxminddb incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause applications using libmaxminddb to crash, resulting in a denial of service.
first Nov 12, 2020 -
UnscoredUSN-4633-1 3 CVEs
postgresql-10, postgresql-12, postgresql-9.5 vulnerabilities
Peter Eisentraut discovered that PostgreSQL incorrectly handled connection security settings. Client applications could possibly be connecting with certain security parameters dropped, contrary to expectations. (CVE-2020-25694) Etienne Stalmans discovered tha…
first Nov 17, 2020 -
High max 7.5USN-4619-1 1 CVE
dom4j vulnerability
Mário Areias discovered that dom4j did not properly validate XML document elements. An attacker could exploit this with a crafted XML file to cause dom4j to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-1000632)
first Nov 5, 2020 -
UnscoredUSN-4617-1 4 CVEs
spice-vdagent vulnerabilities
Matthias Gerstner discovered that SPICE vdagent incorrectly handled the active_xfers hash table. A local attacker could possibly use this issue to cause SPICE vdagent to consume memory, resulting in a denial of service. (CVE-2020-25650) Matthias Gerstner disc…
first Nov 4, 2020 -
UnscoredUSN-4609-1 3 CVEs
gosa vulnerabilities
Fabian Henneke discovered that GOsa incorrectly handled client cookies. An authenticated user could exploit this with a crafted cookie to perform file deletions in the context of the user account that runs the web server. (CVE-2019-14466) It was discovered th…
first Oct 28, 2020 -
Medium max 5.9USN-4891-1 1 CVE
openssl vulnerability
It was discovered that OpenSSL incorrectly handled certain renegotiation ClientHello messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service.
first Mar 25, 2021 -
UnscoredUSN-4641-1 12 CVEs
libextractor vulnerabilities
It was discovered that Libextractor incorrectly handled zero sample rate. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15266) It was discovered that Libextractor incorrectly handled certain FLAC metadata. An attacker could…
first Nov 23, 2020 -
Medium max 5.5USN-4603-1 6 CVEs
mariadb-10.1, mariadb-10.3 vulnerabilities
It was discovered that MariaDB didn't properly validate the content of a packet received from a server. A remote attacker could use this vulnerability to sent a specialy crafted file to cause a denial of service. (CVE-2020-13249) It was discovered that MariaD…
first Oct 27, 2020 -
High max 7.5USN-4601-1 1 CVE
python-pip vulnerability
It was discovered that pip did not properly sanitize the filename during pip install. A remote attacker could possible use this issue to read and write arbitrary files on the host filesystem as root, resulting in a directory traversal attack. (CVE-2019-20916)
first Oct 22, 2020 -
Critical max 9.1USN-4600-2 3 CVEs
netty vulnerabilities
USN-4600-1 fixed multiple vunerabilities in Netty 3.9. This update provides the corresponding fixes for CVE-2019-20444, CVE-2019-20445 for Netty. Also it was discovered that Netty allow for unbounded memory allocation. A remote attacker could send a large str…
first Oct 27, 2020 -
Medium max 5.3USN-4607-1 8 CVEs
openjdk-8, openjdk-lts vulnerabilities
It was discovered that OpenJDK incorrectly handled deserializing Proxy class objects with many interfaces. A remote attacker could possibly use this issue to cause a denial of service (memory consumption) via a specially crafted input. (CVE-2020-14779) Sergey…
first Oct 27, 2020 -
High max 8.1USN-4584-1 1 CVE
htmlunit vulnerability
It was discovered that HtmlUnit incorrectly initialized Rhino engine. An Attacker could possibly use this issue to execute arbitrary Java code.
first Oct 15, 2020 -
Medium max 4.9USN-4586-1 1 CVE
php-imagick vulnerability
It was discovered that PHP ImageMagick extension didn't check the address used by an array. An attacker could use this issue to cause PHP ImageMagick to crash, resulting in a denial of service.
first Oct 20, 2020 -
UnscoredUSN-4594-1 2 CVEs
quassel vulnerabilities
It was discovered that Quassel incorrectly handled Qdatastream protocol. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-1000178) It was discovered that Quassel incorrectly handled certain login requests. A remote attacker…
first Oct 20, 2020 -
UnscoredUSN-4572-1 1 CVE
spice vulnerability
Frediano Ziglio discovered that Spice incorrectly handled QUIC image decoding. A remote attacker could use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Oct 6, 2020 -
UnscoredUSN-4569-1 2 CVEs
yaws vulnerabilities
It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity (XXE) injection attack. (CVE-2020-24379) It was discovered that Yaws mishandled certain input when running CGI sc…
first Oct 5, 2020 -
Critical max 9.8USN-4562-1 1 CVE
ruby-kramdown vulnerability
It was discovered that kramdown insecurely handled certain crafted input. An attacker could use this vulnerability to read restricted files or execute arbitrary code.
first Sep 30, 2020 -
UnscoredUSN-4520-1 1 CVE
sa-exim vulnerability
It was discovered that Exim SpamAssassin does not properly handle configuration strings. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-19920)
first Sep 18, 2020 -
Medium max 6.1USN-4560-1 1 CVE
ruby-gon vulnerability
It was discovered that Gon gem did not properly escape certain input. An attacker could use this vulnerability to execute a cross-site scripting (XSS) attack.
first Sep 30, 2020 -
Medium max 5.3USN-4571-1 1 CVE
ruby-rack-cors vulnerability
It was discovered that rack-cors did not properly handle relative file paths. An attacker could use this vulnerability to access arbitrary files.
first Oct 5, 2020 -
UnscoredUSN-4547-2 4 CVEs
ssvnc vulnerabilities
It was discovered that the LibVNCClient vendored in SSVNC incorrectly handled certain packet lengths. A remote attacker could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary code. (CVE-2018-20020, CVE-2…
first Sep 28, 2020 -
Critical max 9.8USN-4575-1 1 CVE
dom4j vulnerability
It was discovered that dom4j incorrectly handled reading XML data. A remote attacker could exploit this with a crafted XML file to expose sensitive data or possibly execute arbitrary code. (CVE-2020-10683)
first Oct 13, 2020 -
UnscoredUSN-4572-2 1 CVE
spice vulnerability
USN-4572-1 fixed a vulnerability in Spice. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Frediano Ziglio discovered that Spice incorrectly handled QUIC image decoding. A remote attacker could use this to cause …
first Oct 7, 2020 -
Medium max 4.8USN-4574-1 1 CVE
golang-github-seccomp-libseccomp-golang vulnerability
It was discovered that libseccomp-golang did not properly generate BPFs. If a process were running under a restrictive seccomp filter that specified multiple syscall arguments, the application could potentially bypass the intended restrictions put in place by…
first Oct 7, 2020 -
UnscoredUSN-4573-1 7 CVEs
vino vulnerabilities
Nicolas Ruff discovered that Vino incorrectly handled large ClientCutText messages. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. (CVE-2014-6053) It was discovered that Vino incorrectly handled certain …
first Oct 7, 2020 -
Medium max 6.5USN-4570-1 1 CVE
python-urllib3 vulnerability
It was discovered that urllib3 incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection.
first Oct 5, 2020 -
UnscoredUSN-4542-1 5 CVEs
miniupnpd vulnerabilities
It was discovered that MiniUPnPd did not properly validate callback addresses. A remote attacker could possibly use this issue to expose sensitive information. (CVE-2019-12107) It was discovered that MiniUPnPd incorrectly handled unpopulated user XML input. A…
first Sep 25, 2020 -
Medium max 5.5USN-4564-1 2 CVEs
tika vulnerabilities
It was discovered that Apache Tika can have an excessive memory usage by using a crafted or corrupt PSD file. An attacker could use it to cause a denial of service (crash). (CVE-2020-1950, CVE-2020-1951)
first Oct 5, 2020 -
High max 7.3USN-4543-1 1 CVE
ruby-sanitize vulnerability
Michał Bentkowski discovered that Sanitize did not properly sanitize some math or svg HTML under certain circumstances. A remote attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2020-4054)
first Sep 25, 2020 -
UnscoredUSN-4553-1 1 CVE
teeworlds vulnerability
It was discovered that Teeworlds server did not properly handler certain network traffic. A remote, unauthenticated attacker could use this vulnerability to cause Teeworlds server to crash.
first Sep 28, 2020 -
UnscoredUSN-4523-1 1 CVE
libofx vulnerability
It was discovered that LibOFX did not properly check for errors in certain situations, leading to a NULL pointer dereference. A remote attacker could use this issue to cause a denial of service attack. (CVE-2019-9656)
first Sep 21, 2020 -
Critical max 9.1USN-4532-1 3 CVEs
netty-3.9 vulnerabilities
It was discovered that Netty incorrectly handled certain HTTP headers. By sending an HTTP header with whitespace before the colon, a remote attacker could possibly use this issue to perform an HTTP request smuggling attack. (CVE-2019-16869) It was discovered …
first Sep 22, 2020 -
UnscoredUSN-4530-1 1 CVE
debian-lan-config vulnerabilities
Wolfgang Schweer discovered that Debian-LAN did not properly handle ACLs for the Kerberos admin server. A local attacker could possibly use this issue to change the passwords of other users, leading to root privilege escalation. (CVE-2019-3467)
first Sep 22, 2020 -
UnscoredUSN-4541-1 3 CVEs
gnuplot vulnerabilities
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars discovered that Gnuplot did not properly validate string sizes in the df_generate_ascii_array_entry function. An attacker could possibly use this issue to cause a heap buffer overflow, resultin…
first Sep 25, 2020 -
UnscoredUSN-4539-1 1 CVE
awl vulnerability
Andrew Bartlett discovered that DAViCal Andrew's Web Libraries (AWL) did not properly manage session keys. An attacker could possibly use this issue to impersonate a session. (CVE-2020-11728)
first Sep 24, 2020 -
UnscoredUSN-4518-1 1 CVE
xawtv vulnerability
Matthias Gerstner discovered that xawtv incorrectly handled opening files. A local attacker could possibly use this issue to open and write to arbitrary files and escalate privileges. (CVE-2020-13696)
first Sep 17, 2020 -
Medium max 5.3USN-4516-1 1 CVE
gnupg2 vulnerability
It was discovered that GnuPG signatures could be forged when the SHA-1 algorithm is being used. This update removes validating signatures based on SHA-1 that were generated after 2019-01-19. In environments where this is still required, a new option --allow-w…
first Sep 17, 2020 -
UnscoredUSN-4513-1 1 CVE
apng2gif vulnerability
Dileep Kumar Jallepalli discovered that apng2gif incorrectly handled loading APNG files. An attacker could exploit this with a crafted APNG file to access sensitive information. (CVE-2017-6960)
first Sep 17, 2020 -
Medium max 6.1USN-4522-1 1 CVE
novnc vulnerability
It was discovered that noVNC did not properly manage certain messages, resulting in the remote VNC server injecting arbitrary HTML into the noVNC web page. An attacker could use this issue to conduct cross-site scripting (XSS) attacks. (CVE-2017-18635)
first Sep 21, 2020