8,464 results · Feed
-
UnscoredUSN-3838-1 7 CVEs
libraw vulnerabilities
It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of servi…
first Dec 6, 2018 -
High max 7.5USN-3790-1 1 CVE
requests vulnerability
It was discovered that Requests incorrectly handled certain HTTP headers. An attacker could possibly use this issue to access sensitive information.
first Oct 15, 2018 -
Medium max 4.3USN-3787-1 1 CVE
tomcat7, tomcat8 vulnerability
It was discovered that Tomcat incorrectly handled returning redirects to a directory. A remote attacker could possibly use this issue with a specially crafted URL to redirect to arbitrary URIs.
first Oct 10, 2018 -
UnscoredUSN-4070-1 13 CVEs
mysql-5.7 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.27. In addition to security fixes, the updated pac…
first Jul 24, 2019 -
High max 8.3USN-3751-1 1 CVE
spice, spice-protocol vulnerability
It was discovered that Spice incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service.
first Aug 22, 2018 -
UnscoredUSN-3737-1 1 CVE
gdm3 vulnerability
A use-after-free was discovered in GDM. A local user could exploit this to cause a denial of service, or potentially execute arbitrary code as the administrator.
first Aug 13, 2018 -
UnscoredUSN-3760-1 1 CVE
transfig vulnerability
It was discovered that transfig incorrectly handled certain FIG files. An attacker could possibly use this to execute arbitrary code.
first Sep 6, 2018 -
Critical max 9.8USN-3685-2 1 CVE
ruby2.0 regression
USN-3685-1 fixed a vulnerability in Ruby. The fix for CVE-2017-0903 introduced a regression in Ruby. This update fixes the problem. Original advisory details: Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address fo…
first Mar 25, 2021 -
High max 7.5USN-4189-1 1 CVE
dpdk vulnerability
Jason Wang discovered that DPDK incorrectly handled certain messages. An attacker in a malicious container could possibly use this issue to cause DPDK to leak resources, resulting in a denial of service.
first Nov 13, 2019 -
Critical max 9.8USN-3661-1 1 CVE
batik vulnerability
It was discovered that Batik incorrectly handled certain XML. An attacker could possibly use this to expose sensitive information.
first May 29, 2018 -
UnscoredUSN-3659-1 1 CVE
spice, spice-protocol vulnerability
Frediano Ziglio discovered that Spice incorrectly handled certain client messages. An attacker could possibly use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.
first May 23, 2018 -
UnscoredUSN-3667-1 5 CVEs
libytnef vulnerabilities
It was discovered that libytnef incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2017-12141, CVE-2017-9146, CVE-2017-9471, CVE-2017-9473) It was discovered that libytnef incorrectly handled certain file…
first May 31, 2018 -
UnscoredUSN-3675-2 1 CVE
gnupg2 vulnerability
USN-3675-1 fixed a vulnerability in GnuPG 2 for Ubuntu 18.04 LTS and Ubuntu 17.10. This update provides the corresponding update for GnuPG 2 in Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. Original advisory details: Marcus Brinkmann discovered that during decryptio…
first Jun 15, 2018 -
UnscoredUSN-3957-2 2 CVEs
mariadb-5.5 vulnerabilities
USN-3957-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2019-2614 and CVE-2019-2627 in MariaDB 5.5. Ubuntu 14.04 LTS has been updated to MariaDB 5.5.64. In addition to security fixes, the updated packages conta…
first May 23, 2019 -
UnscoredUSN-3642-1 1 CVE
dpdk vulnerability
Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information.
first May 9, 2018 -
High max 7.8USN-3621-2 1 CVE
ruby1.9.1, ruby2.0 regression
USN-3621-1 fixed vulnerabilities in Ruby. The update caused an issue due to an incomplete patch for CVE-2018-1000074. This update reverts the problematic patch pending further investigation. We apologize for the inconvenience. Original advisory details: It wa…
first Apr 13, 2018 -
Critical max 9.8USN-3553-1 3 CVEs
ruby2.3 vulnerabilities
It was discovered that Ruby failed to validate specification names. An attacker could possibly use a maliciously crafted gem to potentially overwrite any file on the filesystem. (CVE-2017-0901) It was discovered that Ruby was vulnerable to a DNS hijacking vul…
first Jan 31, 2018 -
Medium max 5.7USN-5835-1 1 CVE
cinder vulnerability
Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that Cinder incorrectly handled VMDK image processing. An authenticated attacker could possibly supply a specially crafted VMDK flat image and obtain arbitrary files from the server …
first Jan 31, 2023 -
UnscoredUSN-3615-1 5 CVEs
libraw vulnerabilities
It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of servi…
first Apr 3, 2018 -
UnscoredUSN-3639-1 2 CVEs
libraw vulnerabilities
It was discovered that LibRaw incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. (CVE-2018-10528) It was discovered that LibRaw incorrectly handled certain files. An attacker could possibly use this to obtain sen…
first May 8, 2018 -
Critical max 9.8USN-3621-1 7 CVEs
ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities
It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. (CVE-2018-1000073) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execu…
first Apr 5, 2018 -
UnscoredUSN-3618-1 1 CVE
libvncserver vulnerability
It was discovered that LibVNCServer incorrectly handled certain packet lengths. A remote attacker able to connect to a LibVNCServer could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary code.
first Apr 4, 2018 -
Critical max 9.1USN-3519-1 4 CVEs
tomcat7, tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly handled certain pipelined requests when sendfile was used. A remote attacker could use this issue to obtain wrong responses possibly containing sensitive information. (CVE-2017-5647) It was discovered that Tomcat inco…
first Jan 8, 2018 -
UnscoredUSN-3459-1 16 CVEs
mysql-5.5, mysql-5.7 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.58 in Ubuntu 14.04 LTS. Ubuntu 16.04 LTS, Ubuntu 17.04 and Ubuntu 17.10 have been updated to MySQL 5.7.20…
first Oct 23, 2017 -
UnscoredUSN-3492-1 9 CVEs
libraw vulnerabilities
It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of servi…
first Nov 22, 2017 -
UnscoredUSN-3044-1 22 CVEs
firefox vulnerabilities
Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtai…
first Aug 5, 2016 -
UnscoredUSN-2985-1 11 CVEs
eglibc, glibc vulnerabilities
Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information. (CVE-2013-2207, CVE-2016-2856) Robin Hack disco…
first May 25, 2016 -
UnscoredUSN-2698-1 3 CVEs
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled skip-scan optimization. An attacker could use this issue to cause applications using SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04…
first Jul 30, 2015 -
UnscoredUSN-2594-1 5 CVEs
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled certain malformed files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, attackers would be i…
first May 5, 2015 -
UnscoredUSN-2572-1 6 CVEs
php5 vulnerabilities
It was discovered that PHP incorrectly handled cleanup when used with Apache 2.4. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-3330) It was discovered that PHP in…
first Apr 20, 2015 -
UnscoredUSN-2500-1 2 CVEs
xorg-server, xorg-server-lts-trusty, xorg-server-lts-utopic vulnerabilities
Olivier Fourdan discovered that the X.Org X server incorrectly handled XkbSetGeometry requests resulting in an information leak. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly obtain sensitive informat…
first Feb 17, 2015 -
UnscoredUSN-2365-1 5 CVEs
libvncserver vulnerabilities
Nicolas Ruff discovered that LibVNCServer incorrectly handled memory when being advertised large screen sizes by the server. If a user were tricked into connecting to a malicious server, an attacker could use this issue to cause a denial of service, or possib…
first Sep 29, 2014 -
High max 7.5USN-4738-1 2 CVEs
openssl, openssl1.0 vulnerabilities
Paul Kehrer discovered that OpenSSL incorrectly handled certain input lengths in EVP functions. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2021-23840) Tavis Ormandy discovered that OpenSSL…
first Feb 18, 2021 -
High max 7.5USN-3365-1 7 CVEs
ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities
It was discovered that Ruby DL::dlopen incorrectly handled opening libraries. An attacker could possibly use this issue to open libraries with tainted names. This issue only applied to Ubuntu 14.04 LTS. (CVE-2009-5147) Tony Arcieri, Jeffrey Walton, and Steffa…
first Jul 25, 2017 -
High max 8.1USN-3045-1 25 CVEs
php5, php7.0 vulnerabilities
It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LT…
first Aug 2, 2016 -
UnscoredUSN-2677-1 13 CVEs
oxide-qt vulnerabilities
An uninitialized value issue was discovered in ICU. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-1270) A use-after-free was discovered in the GPU process i…
first Aug 4, 2015 -
UnscoredUSN-3308-1 2 CVEs
puppet vulnerabilities
Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this issue to possibly execute arbitrary code. (CVE-2014-3248) It was discovered that Puppet incorrectly handled YAML deserialization. A remote attacker could p…
first Jun 5, 2017 -
Critical max 9.8
tomcat6, tomcat7, tomcat8 vulnerabilities
It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use this issue to enumerate usernames. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubunt…
first Jan 23, 2017 -
UnscoredUSN-2952-1 8 CVEs
php5 vulnerabilities
It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories. (CVE-2014-9767) It was discovered that the PHP Soap client incorre…
first Apr 21, 2016 -
UnscoredUSN-2187-1 24 CVEs
openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-0429, CVE-2014-044…
first Apr 30, 2014