8,464 results · Feed
-
UnscoredUSN-3173-2 1 CVE
nvidia-graphics-drivers-375 vulnerability
USN-3173-1 fixed a vulnerability in nvidia-graphics-drivers-304 and nvidia-graphics-drivers-340. This update provides the corresponding update for nvidia-graphics-drivers-375. Original advisory details: It was discovered that the NVIDIA graphics drivers conta…
first Mar 21, 2017 -
UnscoredUSN-3119-1 1 CVE
bind9 vulnerability
Tony Finch and Marco Davids discovered that Bind incorrectly handled certain responses containing a DNAME answer. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
first Nov 1, 2016 -
UnscoredUSN-3135-1 0 CVEs
gst-plugins-good0.10, gst-plugins-good1.0 vulnerability
Chris Evans discovered that GStreamer Good Plugins did not correctly handle malformed FLC movie files. If a user were tricked into opening a crafted FLC movie file with a GStreamer application, an attacker could cause a denial of service via application crash…
first Nov 22, 2016 -
UnscoredUSN-3117-1 3 CVEs
libgd2 vulnerabilities
Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed Tiff images. If a user or automated system were tricked into processing a specially crafted Tiff image, an attacker could cause a denial of service. (CVE-2016-6911) Ke Liu d…
first Nov 1, 2016 -
UnscoredUSN-3143-1 1 CVE
c-ares vulnerability
Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A remote attacker could use this issue to cause applications using c-ares to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 30, 2016 -
UnscoredUSN-3131-1 103 CVEs
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …
first Nov 21, 2016 -
Medium max 6.5USN-3123-1 12 CVEs
curl vulnerabilities
It was discovered that curl incorrectly reused client certificates when built with NSS. A remote attacker could possibly use this issue to hijack the authentication of a TLS connection. (CVE-2016-7141) Nguyen Vu Hoang discovered that curl incorrectly handled …
first Nov 3, 2016 -
UnscoredUSN-3142-2 0 CVEs
imagemagick regression
USN-3142-1 fixed vulnerabilities in ImageMagick. The security fixes introduced a regression with text labels and a regression with the text coder. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered …
first Feb 22, 2017 -
UnscoredUSN-3155-1 13 CVEs
firefox vulnerabilities
Multiple security vulnerabilities were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to conduct cross-site scripting (XSS) attacks, obtain sensitive information, cause a de…
first Dec 13, 2016 -
UnscoredUSN-3124-1 18 CVEs
firefox vulnerabilities
Christian Holler, Andrew McCreight, Dan Minor, Tyson Smith, Jon Coppeard, Jan-Ivar Bruaroey, Jesse Ruderman, Markus Stange, Olli Pettay, Ehsan Akhgari, Gary Kwong, Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues in Firefox. If a use…
first Nov 19, 2016 -
UnscoredUSN-3111-1 2 CVEs
firefox vulnerabilities
A use-after-free was discovered in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via program crash, or execute arbitrary code. (CVE-2016-5287) It was …
first Oct 27, 2016 -
UnscoredUSN-3128-1 1 CVE
linux vulnerability
Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a buffer overflow when displaying timeout events via the /proc/keys interface. A local attacker could use this to cause a denial of service (system crash).
first Nov 11, 2016 -
High max 7.5
thunderbird vulnerabilities
Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong, Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially …
first Dec 1, 2016 -
High max 7.5
firefox vulnerabilities
It was discovered that data: URLs can inherit the wrong origin after a HTTP redirect in some circumstances. An attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-9078) A use-after-free was discovered in SVG animations. If a …
first Nov 30, 2016 -
UnscoredUSN-3148-1 6 CVEs
ghostscript vulnerabilities
Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript processes certain Postscript files. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service or possibly execute…
first Dec 2, 2016 -
UnscoredUSN-3136-1 1 CVE
lxc vulnerability
Roman Fiedler discovered a directory traversal flaw in lxc-attach. An attacker with access to an LXC container could exploit this flaw to access files outside of the container.
first Nov 23, 2016 -
UnscoredUSN-3134-1 4 CVEs
python2.7, python3.2, python3.4, python3.5 vulnerabilities
It was discovered that the smtplib library in Python did not return an error when StartTLS fails. A remote attacker could possibly use this to expose sensitive information. (CVE-2016-0772) Rémi Rampin discovered that Python would not protect CGI applications …
first Nov 22, 2016 -
UnscoredUSN-3116-1 1 CVE
dbus vulnerabilities
It was discovered that DBus incorrectly validated the source of ActivationFailure signals. A local attacker could use this issue to cause a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-0245) It was discovered …
first Nov 1, 2016 -
High max 7.0
linux vulnerability
It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges.
first Oct 20, 2016 -
High max 8.8
oxide-qt vulnerabilities
Multiple security vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, cause a denial of service via application crash, or e…
first Dec 1, 2016 -
UnscoredUSN-3127-1 4 CVEs
linux vulnerabilities
It was discovered that the compression handling code in the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel did not properly check for an integer overflow. A local attacker could use this to cause a denial of service (system crash). (CV…
first Nov 11, 2016 -
UnscoredUSN-3087-2 0 CVEs
openssl regression
USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Shi Lei discovered that Open…
first Sep 23, 2016 -
UnscoredUSN-3093-1 3 CVEs
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled certain malformed files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, attackers would be i…
first Sep 28, 2016 -
UnscoredUSN-3122-1 2 CVEs
nvidia-graphics-drivers-304, nvidia-graphics-drivers-340, nvidia-graphics-drivers-367 vulnerability
It was discovered that the NVIDIA graphics drivers incorrectly sanitized user mode inputs. A local attacker could use this issue to possibly gain root privileges.
first Nov 3, 2016 -
Low max 1.8USN-3113-1 10 CVEs
oxide-qt vulnerabilities
It was discovered that a long running unload handler could cause an incognito profile to be reused in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive informat…
first Nov 2, 2016 -
UnscoredUSN-3094-1 0 CVEs
systemd vulnerability
Andrew Ayer discovered that Systemd improperly handled zero-length notification messages. A local unprivileged attacker could use this to cause a denial of service (init crash leading to system unavailability).
first Sep 29, 2016 -
UnscoredUSN-3091-1 7 CVEs
oxide-qt vulnerabilities
A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-…
first Oct 7, 2016 -
UnscoredUSN-3088-1 1 CVE
bind9 vulnerability
It was discovered that Bind incorrectly handled building responses to certain specially crafted requests. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
first Sep 27, 2016 -
UnscoredUSN-3112-1 11 CVEs
thunderbird vulnerabilities
Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could pote…
first Oct 27, 2016 -
UnscoredUSN-3095-1 17 CVEs
php5, php7.0 vulnerabilities
Taoguang Chen discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7124) Taoguang…
first Oct 4, 2016 -
UnscoredUSN-3101-1 0 CVEs
tracker vulnerability
It was discovered that Tracker incorrectly handled certain malformed GIF images. If a user or automated system were tricked into downloading a specially-crafted GIF image, Tracker could crash, resulting in a denial of service.
first Oct 12, 2016 -
UnscoredUSN-3086-1 2 CVEs
irssi vulnerabilities
Gabriel Campana and Adrien Guinet discovered that the format parsing code in Irssi did not properly verify 24bit color codes. A remote attacker could use this to cause a denial of service (application crash). (CVE-2016-7044) Gabriel Campana and Adrien Guinet …
first Sep 21, 2016 -
UnscoredUSN-3099-1 4 CVEs
linux vulnerabilities
Vladimír Beneš discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO) processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service (system crash). (CV…
first Oct 11, 2016 -
UnscoredUSN-3085-1 3 CVEs
gdk-pixbuf vulnerabilities
It was discovered that the GDK-PixBuf library did not properly handle specially crafted bmp images, leading to a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted bmp file, a remote attacker could use this…
first Sep 21, 2016 -
UnscoredUSN-3075-1 8 CVEs
imlib2 vulnerabilities
Jakub Wilk discovered an out of bounds read in the GIF loader implementation in Imlib2. An attacker could use this to cause a denial of service (application crash) or possibly obtain sensitive information. (CVE-2016-3994) Yuriy M. Kaminskiy discovered an off-…
first Sep 9, 2016 -
UnscoredUSN-3092-1 1 CVE
samba vulnerability
Stefan Metzmacher discovered that Samba incorrectly handled certain flags in SMB2/3 client connections. A remote attacker could use this issue to disable client signing and impersonate servers by performing a machine-in-the-middle attack. Samba has been updat…
first Sep 28, 2016 -
UnscoredUSN-3084-1 3 CVEs
linux vulnerabilities
Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker could use this to corrupt audit logs or disrupt system-call auditing. (CVE-2016-6136) It was discovered that the powerpc and powerpc64 hypervisor-mode KVM im…
first Sep 19, 2016 -
High max 7.0
linux vulnerability
It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges.
first Oct 20, 2016 -
UnscoredUSN-3098-1 4 CVEs
linux vulnerabilities
Vladimír Beneš discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO) processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service (system crash). (CV…
first Oct 11, 2016 -
UnscoredUSN-3071-1 5 CVEs
linux vulnerabilities
Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-5244) Yue Cao et al discovered a fla…
first Aug 29, 2016