8,464 results · Feed
-
UnscoredUSN-3069-1 1 CVE
eog vulnerability
It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or p…
first Aug 25, 2016 -
UnscoredUSN-3079-1 16 CVEs
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …
first Sep 14, 2016 -
UnscoredUSN-3083-1 2 CVEs
linux vulnerabilities
Dmitry Vyukov discovered that the IPv6 implementation in the Linux kernel did not properly handle options data, including a use-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-20…
first Sep 19, 2016 -
UnscoredUSN-3068-1 5 CVEs
libidn vulnerabilities
Thijs Alkemade, Gustavo Grieco, Daniel Stenberg, and Nikos Mavrogiannopoulos discovered that Libidn incorrectly handled invalid UTF-8 characters. A remote attacker could use this issue to cause Libidn to crash, resulting in a denial of service, or possibly di…
first Aug 24, 2016 -
UnscoredUSN-3070-1 8 CVEs
linux vulnerabilities
A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw to gain access to any file by setting an ACL. (CVE-2016-1237) Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implement…
first Aug 29, 2016 -
UnscoredUSN-3066-1 2 CVEs
postgresql-9.1, postgresql-9.3, postgresql-9.5 vulnerabilities
Heikki Linnakangas discovered that PostgreSQL incorrectly handled certain nested CASE/WHEN expressions. A remote attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. (CVE-2016-5423) Nathan Bossart discovered t…
first Aug 18, 2016 -
UnscoredUSN-3073-1 1 CVE
thunderbird vulnerabilities
Christian Holler, Carsten Book, Gary Kwong, Jesse Ruderman, Andrew McCreight, and Phil Ringnalda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit t…
first Sep 22, 2016 -
UnscoredUSN-3055-1 4 CVEs
linux vulnerabilities
Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative…
first Aug 10, 2016 -
UnscoredUSN-3060-1 3 CVEs
libgd2 vulnerabilities
It was discovered that the GD library incorrectly handled certain malformed TGA images. If a user or automated system were tricked into processing a specially crafted TGA image, an attacker could cause a denial of service. (CVE-2016-6132, CVE-2016-6214) It wa…
first Aug 10, 2016 -
UnscoredUSN-3042-1 1 CVE
kde4libs vulnerability
Andreas Cord-Landwehr discovered that KDE-Libs incorrectly handled extracting certain archives. If a user were tricked into extracting a specially-crafted archive, a remote attacker could use this issue to overwrite arbitrary files out of the extraction direc…
first Jul 26, 2016 -
UnscoredUSN-3034-1 1 CVE
linux vulnerability
Jan Stancek discovered that the Linux kernel's memory manager did not properly handle moving pages mapped by the asynchronous I/O (AIO) ring buffer to the other nodes. A local attacker could use this to cause a denial of service (system crash).
first Jul 14, 2016 -
UnscoredUSN-3031-1 16 CVEs
pidgin vulnerabilities
Yves Younan discovered that Pidgin contained multiple issues in the MXit protocol support. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jul 12, 2016 -
UnscoredUSN-3076-1 18 CVEs
firefox vulnerabilities
Atte Kettunen discovered an out-of-bounds read when handling certain Content Security Policy (CSP) directives in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial…
first Sep 22, 2016 -
UnscoredUSN-3067-1 2 CVEs
harfbuzz vulnerabilities
Kostya Serebryany discovered that HarfBuzz incorrectly handled memory. A remote attacker could use this issue to cause HarfBuzz to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8947) It was discovered that HarfBuzz inc…
first Aug 24, 2016 -
UnscoredUSN-3058-1 16 CVEs
oxide-qt vulnerabilities
An issue was discovered in Blink involving the provisional URL for an initially empty document. An attacker could potentially exploit this to spoof the currently displayed URL. (CVE-2016-5141) A use-after-free was discovered in the WebCrypto implementation in…
first Sep 14, 2016 -
High max 8.8USN-3041-1 14 CVEs
oxide-qt vulnerabilities
Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service (application crash) or execute arbitrar…
first Aug 5, 2016 -
UnscoredUSN-3048-1 3 CVEs
curl vulnerabilities
Bru Rom discovered that curl incorrectly handled client certificates when resuming a TLS session. (CVE-2016-5419) It was discovered that curl incorrectly handled client certificates when reusing TLS connections. (CVE-2016-5420) Marcelo Echeverria and Fernando…
first Aug 8, 2016 -
UnscoredUSN-3052-1 2 CVEs
linux vulnerabilities
It was discovered that the keyring implementation in the Linux kernel did not ensure a data structure was initialized before referencing it after an error condition occurred. A local attacker could use this to cause a denial of service (system crash). (CVE-20…
first Aug 10, 2016 -
UnscoredUSN-3026-2 1 CVE
libusbmuxd vulnerability
It was discovered that libusbmuxd incorrectly handled socket permissions. A remote attacker could use this issue to access services on iOS devices, contrary to expectations.
first Jul 5, 2016 -
UnscoredUSN-3065-1 1 CVE
libgcrypt11, libgcrypt20 vulnerability
Felix Dörre and Vladimir Klebanov discovered that Libgcrypt incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits from the RNG can trivially predict the next 160 bits of output.
first Aug 18, 2016 -
UnscoredUSN-4082-1 2 CVEs
subversion vulnerabilities
Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker could possibly use this issue to cause svnserver to crash, resulting in a denial of service. (CVE-2018-11782) Tomas Bortoli discovered that Subversion inc…
first Jul 31, 2019 -
UnscoredUSN-3028-1 1 CVE
nspr vulnerability
It was discovered that NSPR incorrectly handled memory allocation. A remote attacker could use this issue to cause NSPR to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jul 11, 2016 -
UnscoredUSN-3038-1 1 CVE
apache2 vulnerability
It was discovered that the Apache HTTP Server would set the HTTP_PROXY environment variable based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this issue in combination with CGI scripts that honour the HTTP_PROX…
first Jul 18, 2016 -
UnscoredUSN-3025-1 1 CVE
gimp vulnerability
It was discovered that GIMP incorrectly handled malformed XCF files. If a user were tricked into opening a specially crafted XCF file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.
first Jul 5, 2016 -
UnscoredUSN-3063-1 1 CVE
fontconfig vulnerability
Tobias Stoeckmann discovered that Fontconfig incorrectly handled cache files. A local attacker could possibly use this issue with a specially crafted cache file to elevate privileges.
first Aug 17, 2016 -
UnscoredUSN-3032-1 1 CVE
ecryptfs-utils vulnerability
It was discovered that eCryptfs incorrectly configured the encrypted swap partition for certain drive types. An attacker could use this issue to discover sensitive information.
first Jul 14, 2016 -
UnscoredUSN-3029-1 1 CVE
nss vulnerability
Tyson Smith and Jed Davis discovered that NSS incorrectly handled memory. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code. This update refreshes the NSS package to version 3.23…
first Jul 11, 2016 -
UnscoredUSN-3022-1 1 CVE
libreoffice vulnerability
It was discovered that LibreOffice incorrectly handled RTF document files. If a user were tricked into opening a specially crafted RTF document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code.
first Jun 29, 2016 -
UnscoredUSN-3023-1 2 CVEs
thunderbird vulnerabilities
It was discovered that NSPR incorrectly handled memory allocation. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE…
first Jul 18, 2016 -
UnscoredUSN-3059-1 1 CVE
xmlrpc-epi vulnerability
It was discovered that xmlrpc-epi incorrectly handled lengths in the simplestring_addn function. A remote attacker could use this issue to cause applications using xmlrpc-epi such as PHP to crash, resulting in a denial of service, or possibly execute arbitrar…
first Aug 10, 2016 -
UnscoredUSN-3030-1 5 CVEs
libgd2 vulnerabilities
It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2013-7456) It was discovered that …
first Jul 11, 2016 -
High max 8.1USN-2994-1 16 CVEs
libxml2 vulnerabilities
It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. (CVE-201…
first Jun 6, 2016 -
UnscoredUSN-3026-1 1 CVE
libimobiledevice vulnerability
It was discovered that libimobiledevice incorrectly handled socket permissions. A remote attacker could use this issue to access services on iOS devices, contrary to expectations.
first Jul 5, 2016 -
UnscoredUSN-3033-1 20 CVEs
libarchive vulnerabilities
Hanno Böck discovered that libarchive contained multiple security issues when processing certain malformed archive files. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code…
first Jul 14, 2016 -
UnscoredUSN-3015-1 1 CVE
oxide-qt vulnerabilities
Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash, or execute arbit…
first Jun 30, 2016 -
UnscoredUSN-3016-1 8 CVEs
linux vulnerabilities
Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denia…
first Jun 27, 2016 -
UnscoredUSN-3018-1 8 CVEs
linux vulnerabilities
Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denia…
first Jun 27, 2016 -
UnscoredUSN-2989-1 10 CVEs
linux vulnerabilities
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117) Jason A. Donenfeld disc…
first Jun 1, 2016 -
High max 8.4
imagemagick vulnerabilities
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly sanitized untrusted input. A remote attacker could use these issues to execute arbitrary code. These issues are known as "ImageTragick". This update disables problematic coders via the /etc/…
first Jun 2, 2016 -
UnscoredUSN-3014-1 2 CVEs
spice vulnerabilities
Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 15.10 and…
first Jun 21, 2016