8,464 results · Feed
-
UnscoredUSN-5025-1 1 CVE
libsndfile vulnerability
It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jul 29, 2021 -
UnscoredUSN-5035-1 0 CVEs
gpsd vulnerability
It was discovered that GPSd incorrectly handled certain leap second events which would result in the time jumping back 1024 weeks on 2021-10-31.
first Aug 10, 2021 -
UnscoredUSN-5034-1 1 CVE
c-ares vulnerability
Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly validated certain hostnames returned by DNS servers. A remote attacker could possibly use this issue to perform Domain Hijacking attacks.
first Aug 10, 2021 -
High max 8.8
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site s…
first Jul 28, 2021 -
Medium max 4.7USN-5043-2 1 CVE
exiv2 regression
USN-5043-1 fixed vulnerabilities in Exiv2. The update introduced a new regression that could cause a crash in applications using libexiv2. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Exi…
first Jan 11, 2022 -
UnscoredUSN-5011-1 7 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, overlay text over another domain, or execute arbitrary code.
first Jul 16, 2021 -
UnscoredUSN-5007-1 1 CVE
libuv1 vulnerability
Eric Sesterhenn discovered that libuv incorrectly handled certain strings. An attacker could possibly use this issue to access sensitive information or cause a crash.
first Jul 7, 2021 -
UnscoredUSN-5026-1 2 CVEs
qpdf vulnerabilities
It was discovered that QPDF incorrectly handled certain malformed PDF files. A remote attacker could use this issue to cause QPDF to consume resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-18020) It was discov…
first Jul 29, 2021 -
UnscoredUSN-4995-2 20 CVEs
thunderbird vulnerabilities
USN-4995-1 fixed vulnerabilities in Thunderbird. This update provides the corresponding updates for Ubuntu 18.04 LTS. Original advisory details: Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted w…
first Jun 25, 2021 -
UnscoredUSN-4993-1 1 CVE
dovecot vulnerabilities
Kirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT tokens. A local attacker could possibly use this issue to validate tokens using arbitrary keys. This issue only affected Ubuntu 20.10 and Ubuntu 21.04. (CVE-2021-29157) Fabian Ising a…
first Jun 21, 2021 -
UnscoredUSN-5008-1 2 CVEs
avahi vulnerabilities
Thomas Kremer discovered that Avahi incorrectly handled termination signals on the Unix socket. A local attacker could possibly use this issue to cause Avahi to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LT…
first Jul 7, 2021 -
UnscoredUSN-4996-1 5 CVEs
openexr vulnerabilities
It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code.
first Jun 22, 2021 -
UnscoredUSN-4978-1 5 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, re-enable camera devices without an additional permission prompt, s…
first Jun 2, 2021 -
UnscoredUSN-5694-1 6 CVEs
libreoffice vulnerabilities
It was discovered that LibreOffice incorrectly handled links using the Office URI Schemes. If a user were tricked into opening a specially crafted document, a remote attacker could use this issue to execute arbitrary scripts. (CVE-2022-3140) Thomas Florian di…
first Oct 20, 2022 -
UnscoredUSN-4973-2 1 CVE
python3.8 vulnerability
USN-4973-1 fixed this vulnerability previously, but it was re-introduced in python3.8 in focal because of the SRU in LP: #1928057. This update fixes the problem. Original advisory details: It was discovered that the Python stdlib ipaddress API incorrectly han…
first Oct 4, 2021 -
Medium max 4.7USN-4990-1 2 CVEs
nettle vulnerabilities
It was discovered that Nettle incorrectly handled RSA decryption. A remote attacker could possibly use this issue to cause Nettle to crash, resulting in a denial of service. (CVE-2021-3580) It was discovered that Nettle incorrectly handled certain padding ora…
first Jun 17, 2021 -
UnscoredUSN-4995-1 20 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the U…
first Jun 22, 2021 -
UnscoredUSN-4998-1 7 CVEs
ceph vulnerabilities
It was discovered that in some situations Ceph logged passwords from the mgr module in clear text. An attacker could use this to expose sensitive information. (CVE-2020-25678) Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials…
first Jun 25, 2021 -
High max 7.4USN-4969-1 1 CVE
isc-dhcp vulnerability
Jon Franklin and Pawel Wieczorkiewicz discovered that DHCP incorrectly handled lease file parsing. A remote attacker could possibly use this issue to cause DHCP to crash, resulting in a denial of service.
first May 27, 2021 -
Medium max 5.3USN-5006-1 5 CVEs
php7.2, php7.4 vulnerabilities
It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and…
first Jul 7, 2021 -
UnscoredUSN-4973-1 1 CVE
python3.8 vulnerability
It was discovered that the Python stdlib ipaddress API incorrectly handled octal strings. A remote attacker could possibly use this issue to perform a wide variety of attacks, including bypassing certain access restrictions.
first Jun 1, 2021 -
UnscoredUSN-4966-1 1 CVE
libx11 vulnerability
It was discovered that libx11 incorrectly validated certain parameter lengths. A remote attacker could possibly use this issue to trick libx11 into emitting extra X protocol requests.
first May 25, 2021 -
UnscoredUSN-4968-1 1 CVE
lz4 vulnerability
It was discovered that LZ4 incorrectly handled certain memory operations. If a user or automated system were tricked into uncompressing a specially- crafted LZ4 file, a remote attacker could use this issue to cause LZ4 to crash, resulting in a denial of servi…
first May 26, 2021 -
UnscoredUSN-4994-1 5 CVEs
apache2 vulnerabilities
Marc Stern discovered that the Apache mod_proxy_http module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause Apache to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.…
first Jun 21, 2021 -
UnscoredUSN-4944-1 0 CVEs
mariadb-10.1, mariadb-10.3, mariadb-10.5 vulnerabilities
This update fixed multiple vulnerabilities in MariaDB. Ubuntu 18.04 LTS has been updated to MariaDB 10.1.48. Ubuntu 20.04 LTS has been updated to MariaDB 10.3.29. Ubuntu 20.10 has been updated to MariaDB 10.3.29. Ubuntu 21.04 has been updated to MariaDB 10.5.…
first May 11, 2021 -
UnscoredUSN-4957-1 5 CVEs
djvulibre vulnerabilities
It was discovered that DjVuLibre incorrectly handled certain memory operations. If a user or automated system were tricked into processing a specially crafted DjVu file, a remote attacker could cause applications to hang or crash, resulting in a denial of ser…
first May 17, 2021 -
UnscoredUSN-4944-2 0 CVEs
mariadb-10.3 regression
USN-4944-1 fixed vulnerabilities in MariaDB. It caused a regression. This update fixes the problem. Original advisory details: Ubuntu 20.04 has been updated to MariaDB 10.3.30.
first Jul 28, 2021 -
High max 7.1USN-4951-1 1 CVE
flatpak vulnerability
Anton Lydike discovered that Flatpak did not properly handle special tokens in desktop files. An attacker could use this to specially craft a Flatpak application that could escape sandbox confinement.
first May 12, 2021 -
UnscoredUSN-4937-2 0 CVEs
gnome-autoar regression
USN-4937-1 fixed a vulnerability in GNOME Autoar. The update caused a regression when extracting certain archives. This update fixes the problem. Original advisory details: Ondrej Holy discovered that GNOME Autoar could extract files outside of the intended d…
first Jun 7, 2021 -
UnscoredUSN-4942-1 1 CVE
firefox vulnerability
A race condition was discovered in Web Render Components. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code.
first May 10, 2021 -
UnscoredUSN-4958-1 0 CVEs
caribou vulnerability
It was discovered that the Caribou onscreen keyboard could be made to crash when given certain input values. An attacker could use this to bypass screen-locking applications that support using Caribou as an input mechanism.
first May 17, 2021 -
UnscoredUSN-4926-1 12 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass security restrictions, trick the user …
first Apr 26, 2021 -
UnscoredUSN-4936-1 5 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute …
first May 6, 2021 -
UnscoredUSN-4930-1 1 CVE
samba vulnerability
Peter Eriksson discovered that Samba incorrectly handled certain negative idmap cache entries. This issue could result in certain users gaining unauthorized access to files, contrary to expected behaviour.
first Apr 29, 2021 -
UnscoredUSN-4888-1 2 CVEs
ldb vulnerabilities
Douglas Bagnall discovered that ldb, when used with Samba, incorrectly handled certain LDAP attributes. A remote attacker could possibly use this issue to cause the LDAP server to crash, resulting in a denial of service. (CVE-2021-20277) Douglas Bagnall disco…
first Mar 24, 2021 -
High max 7.8
policykit-1 vulnerability
Kevin Backhouse discovered that polkit incorrectly handled errors in the polkit_system_bus_name_get_creds_sync function. A local attacker could possibly use this issue to escalate privileges.
first Jun 3, 2021 -
High max 7.5USN-4918-2 3 CVEs
clamav vulnerabilities
USN-4918-1 fixed several vulnerabilities in ClamAV. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that ClamAV incorrectly handled parsing Excel documents. A remote attacker could possibly use …
first Apr 20, 2021 -
UnscoredUSN-4916-2 0 CVEs
linux, linux-aws, linux-gke-5.3, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem-5.6, linux-raspi2, linux-raspi2-5.3, linux-snapdragon regression
USN-4916-1 fixed vulnerabilities in the Linux kernel. Unfortunately, the fix for CVE-2021-3493 introduced a memory leak in some situations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that th…
first Apr 22, 2021 -
UnscoredUSN-4928-1 2 CVEs
gst-plugins-good1.0 vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. (CVE-2021-3497) It was discovered that GStreamer Good Plugins incorrectly handle…
first Apr 28, 2021 -
Critical max 9.8
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site s…
first May 10, 2021