8,464 results · Feed
-
UnscoredUSN-3454-1 1 CVE
libffi vulnerability
It was discovered that libffi incorrectly enforced an executable stack. An attacker could possibly use this issue, in combination with another vulnerability, to facilitate executing arbitrary code.
first Oct 12, 2017 -
UnscoredUSN-3453-1 2 CVEs
xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities
Michal Srb discovered that the X.Org X server incorrectly handled shared memory segments. An attacker able to connect to an X server, either locally or remotely, could use this issue to crash the server, or possibly replace shared memory segments of other X c…
first Oct 12, 2017 -
UnscoredUSN-3470-1 7 CVEs
linux vulnerabilities
Qian Zhang discovered a heap-based buffer overflow in the tipc_msg_build() function in the Linux kernel. A local attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-8632) …
first Oct 31, 2017 -
UnscoredUSN-3465-1 7 CVEs
irssi vulnerabilities
Brian Carpenter discovered that Irssi incorrectly handled messages with invalid time stamps. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-10965) Brian Carpenter discovered that Irssi incorrec…
first Oct 26, 2017 -
UnscoredUSN-3461-1 5 CVEs
nvidia-graphics-drivers-384 vulnerabilities
It was discovered that the NVIDIA graphics drivers contained flaws in the kernel mode layer. A local attacker could use these issues to cause a denial of service or potentially escalate their privileges on the system.
first Oct 23, 2017 -
UnscoredUSN-3436-1 8 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing-like context, an attacker could potentially exploit these to read uninitialized memory, bypass phishing and malware protect…
first Oct 11, 2017 -
UnscoredUSN-3456-1 12 CVEs
xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities
It was discovered that the X.Org X server incorrectly handled certain lengths. An attacker able to connect to an X server, either locally or remotely, could use these issues to crash the server, or possibly execute arbitrary code.
first Oct 17, 2017 -
UnscoredUSN-3477-4 0 CVEs
firefox regression
USN-3477-1 fixed vulnerabilities in Firefox. The update introduced a crash reporting issue where background tab crash reports were sent to Mozilla without user opt-in. This update fixes the problem. We apologize for the inconvenience. Original advisory detail…
first Jan 3, 2018 -
UnscoredUSN-3475-1 2 CVEs
openssl vulnerabilities
It was discovered that OpenSSL incorrectly parsed the IPAddressFamily extension in X.509 certificates, resulting in an erroneous display of the certificate in text format. (CVE-2017-3735) It was discovered that OpenSSL incorrectly performed the x86_64 Montgom…
first Nov 6, 2017 -
UnscoredUSN-3440-1 9 CVEs
poppler vulnerabilities
It was discovered that Poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service. (CVE-2017-14518, CVE-2017-14520, CVE-2017-14617, CVE-2017-14929, CVE-201…
first Oct 6, 2017 -
UnscoredUSN-3486-1 2 CVEs
samba vulnerabilities
Yihan Lian and Zhibin Hu discovered that Samba incorrectly handled memory when processing certain SMB1 requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2017-14746) Volker Lendecke discovered that Samba incorrectly clea…
first Nov 21, 2017 -
UnscoredUSN-3472-1 2 CVEs
libreoffice vulnerabilities
Marcin Noga discovered that LibreOffice incorrectly handled PPT documents. If a user were tricked into opening a specially crafted PPT document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2017-12607) Marcin N…
first Nov 2, 2017 -
UnscoredUSN-3445-1 2 CVEs
linux vulnerabilities
Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation in the Linux kernel contained a buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute arbitrary code with administrative privileges. (C…
first Oct 10, 2017 -
Medium max 6.5USN-3452-1 4 CVEs
ceph vulnerabilities
It was discovered that Ceph incorrectly handled the handle_command function. A remote authenticated user could use this issue to cause Ceph to crash, resulting in a denial of service. (CVE-2016-5009) Rahul Aggarwal discovered that Ceph incorrectly handled the…
first Oct 11, 2017 -
UnscoredUSN-3434-1 1 CVE
libidn vulnerability
It was discovered that Libidn incorrectly handled decoding certain digits. A remote attacker could use this issue to cause Libidn to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Oct 2, 2017 -
UnscoredUSN-3469-1 12 CVEs
linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Anthony Perard discovered that the Xen virtual block driver did not properly initialize some data structures before passing them to user space. A local attacker in a guest VM could use this to expose sensitive information from the host OS or other guest VMs. …
first Oct 31, 2017 -
UnscoredUSN-3458-1 1 CVE
icu vulnerability
It was discovered that ICU incorrectly handled certain inputs. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.
first Oct 23, 2017 -
UnscoredUSN-3435-1 16 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, bypass phishing and malware protecti…
first Oct 2, 2017 -
UnscoredUSN-3433-1 1 CVE
poppler vulnerabilities
It was discovered that Poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial service. This issue only affected Ubuntu 17.04. (CVE-2017-14517) It was discovered t…
first Oct 2, 2017 -
UnscoredUSN-3460-1 17 CVEs
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …
first Oct 23, 2017 -
UnscoredUSN-3442-1 2 CVEs
libxfont, libxfont1, libxfont2 vulnerabilities
It was discovered that libXfont incorrectly handled certain patterns in PatternMatch. A local attacker could use this issue to cause libXfont to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2017-13720) It was discove…
first Oct 10, 2017 -
Medium max 4.4USN-3422-1 18 CVEs
linux vulnerabilities
It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux kernel when handling L2CAP configuration responses. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-1000251) It was disc…
first Sep 18, 2017 -
UnscoredUSN-3444-1 3 CVEs
linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Jan H. Schönherr discovered that the Xen subsystem did not properly handle block IO merges correctly in some situations. An attacker in a guest vm could use this to cause a denial of service (host crash) or possibly gain administrative privileges in the host.…
first Oct 10, 2017 -
UnscoredUSN-3425-1 1 CVE
apache2 vulnerability
Hanno Böck discovered that the Apache HTTP Server incorrectly handled Limit directives in .htaccess files. In certain configurations, a remote attacker could possibly use this issue to read arbitrary server memory, including sensitive information. This issue …
first Sep 19, 2017 -
UnscoredUSN-3431-1 1 CVE
nss vulnerability
Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Oct 2, 2017 -
UnscoredUSN-3413-1 1 CVE
bluez vulnerability
It was discovered that an information disclosure vulnerability existed in the Service Discovery Protocol (SDP) implementation in BlueZ. A physically proximate unauthenticated attacker could use this to disclose sensitive information. (CVE-2017-1000250)
first Sep 12, 2017 -
Critical max 9.8USN-3424-1 7 CVEs
libxml2 vulnerabilities
It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-0663) It was discovered that libxml2 did not proper…
first Sep 19, 2017 -
UnscoredUSN-3403-1 7 CVEs
ghostscript vulnerabilities
Kamil Frankowicz discovered that Ghostscript mishandles references. A remote attacker could use this to cause a denial of service. (CVE-2017-11714) Kim Gwan Yeong discovered that Ghostscript could allow a heap-based buffer over-read and application crash. A r…
first Aug 28, 2017 -
UnscoredUSN-3435-2 0 CVEs
firefox regression
USN-3435-1 fixed vulnerabilities in Firefox. The update caused the Flash plugin to crash in some circumstances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. …
first Oct 4, 2017 -
UnscoredUSN-3420-1 4 CVEs
linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux kernel when handling L2CAP configuration responses. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-1000251) It was disc…
first Sep 18, 2017 -
UnscoredUSN-3389-1 1 CVE
libgd2 vulnerability
A vulnerability was discovered in GD Graphics Library (aka libgd), as used in PHP that does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read bytes from the top of the stack.
first Aug 14, 2017 -
UnscoredUSN-3416-1 14 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to bypass same-origin restrictions, bypass CSP restrictions, obtain se…
first Sep 14, 2017 -
UnscoredUSN-3390-1 3 CVEs
postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerabilities
Ben de Graaff, Jelte Fennema, and Jeroen van der Ham discovered that PostgreSQL allowed the use of empty passwords in some authentication methods, contrary to expected behaviour. A remote attacker could use an empty password to authenticate to servers that we…
first Aug 15, 2017 -
UnscoredUSN-3388-1 3 CVEs
subversion vulnerabilities
Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A remote attacker could use this to construct a subversion repository that when accessed could run arbitrary code with the privileges of the user. (CVE-2017-…
first Aug 11, 2017 -
High max 7.4USN-3426-1 3 CVEs
samba vulnerabilities
Stefan Metzmacher discovered that Samba incorrectly enforced SMB signing in certain situations. A remote attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2017-12150) Stefan Metzmacher discovered that Samba incorrectly handled encr…
first Sep 21, 2017 -
UnscoredUSN-3410-1 1 CVE
libgd2 vulnerability
It was discovered that the GD Graphics Library (aka libgd) incorrectly handled certain malformed PNG images. A remote attacker could use this issue to cause the GD Graphics Library to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Sep 5, 2017 -
High max 8.8USN-3380-1 8 CVEs
freerdp vulnerabilities
It was discovered that FreeRDP incorrectly handled certain width and height values. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.0…
first Aug 7, 2017 -
Critical max 9.8USN-3383-1 1 CVE
libsoup2.4 vulnerability
Aleksandar Nikolic discovered a stack based buffer overflow when handling chunked encoding. An attacker could use this to cause a denial of service or possibly execute arbitrary code.
first Aug 10, 2017 -
UnscoredUSN-3393-1 3 CVEs
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled parsing certain e-mail messages. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2017-6418) It was discovered that ClamAV incorrectly handled ce…
first Aug 17, 2017 -
UnscoredUSN-3386-1 2 CVEs
linux vulnerabilities
Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload (UFO) code in the Linux kernel. A local attacker could use this to cause a denial of service or execute arbitrary code. (CVE-2017-1000112) Andrey Konovalov discovered a race conditi…
first Aug 11, 2017