8,464 results · Feed
-
UnscoredUSN-3006-1 10 CVEs
linux vulnerabilities
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117) Jann Horn discovered th…
first Jun 10, 2016 -
UnscoredUSN-2960-1 9 CVEs
oxide-qt vulnerabilities
An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code. (CVE-2016-1660) It was dis…
first May 18, 2016 -
UnscoredUSN-2992-1 18 CVEs
oxide-qt vulnerabilities
An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1673) An issue was discovered with Document reatt…
first Jun 6, 2016 -
UnscoredUSN-3406-1 6 CVEs
linux vulnerabilities
It was discovered that an out of bounds read vulnerability existed in the associative array implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2016-7914) It was…
first Aug 28, 2017 -
UnscoredUSN-2979-1 2 CVEs
linux vulnerabilities
David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of se…
first May 16, 2016 -
UnscoredUSN-2950-1 8 CVEs
samba vulnerabilities
Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial of service, downgrade secure connections by performing a machine-in-the-middle attack, or possibly execute…
first Apr 18, 2016 -
UnscoredUSN-2993-1 12 CVEs
firefox vulnerabilities
Christian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy Nikkel, Sylvestre Ledru, Julian Seward, Olli Pettay, Karl Tomlinson, Christoph Diehl, Julian Hector, Jan de Mooij, Mats Palmgren, and Tooru Fujisawa discovered multiple memory safety issues in…
first Jun 9, 2016 -
UnscoredUSN-2999-1 1 CVE
linux vulnerability
Jann Horn discovered that eCryptfs improperly attempted to use the mmap() handler of a lower filesystem that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could use to cause a denial of service (system crash) or…
first Jun 10, 2016 -
UnscoredUSN-4079-2 4 CVEs
sox vulnerabilities
USN-4079-1 fixed vulnerabilities in SoX. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 19.04. Original advisory details: It was discovered that SoX incorrectly handled certain MP3 files. An attacker could possibly use this issu…
first Aug 1, 2019 -
UnscoredUSN-2935-2 0 CVEs
pam regression
USN-2935-1 fixed vulnerabilities in PAM. The updates contained a packaging change that prevented upgrades in certain multiarch environments. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that t…
first Mar 16, 2016 -
UnscoredUSN-2936-1 10 CVEs
firefox vulnerabilities
Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in …
first Apr 27, 2016 -
UnscoredUSN-2984-1 17 CVEs
php5, php7.0 vulnerabilities
It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.…
first May 24, 2016 -
UnscoredUSN-2950-5 0 CVEs
samba regression
USN-2950-1 fixed vulnerabilities in Samba. USN-2950-3 updated Samba to version 4.3.9, which introduced a regression when using the ntlm_auth tool. This update fixes the problem. Original advisory details: Jouni Knuutinen discovered that Samba contained multip…
first May 25, 2016 -
UnscoredUSN-2981-1 1 CVE
libarchive vulnerabilities
It was discovered that libarchive incorrectly handled certain entry-size values in ZIP archives. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied…
first May 17, 2016 -
UnscoredUSN-2980-1 1 CVE
libndp vulnerability
Julien Bernard discovered that libndp incorrectly performed origin checks when receiving Neighbor Discovery Protocol (NDP) messages. A remote attacker outside of the local network could use this issue to advertise a node as a router, causing a denial of servi…
first May 17, 2016 -
UnscoredUSN-2975-1 1 CVE
linux vulnerability
Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbi…
first May 16, 2016 -
UnscoredUSN-2936-3 0 CVEs
firefox regression
USN-2936-1 fixed vulnerabilities in Firefox. The update caused an issue where a device update POST request was sent every time about:preferences#sync was shown. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Chri…
first May 19, 2016 -
UnscoredUSN-2961-1 1 CVE
lcms2 vulnerability
It was discovered that a double free() could occur when the intent handling code in the Little CMS library detected an error. An attacker could use this to specially craft a file that caused an application using the Little CMS library to crash or possibly exe…
first May 4, 2016 -
UnscoredUSN-2935-1 3 CVEs
pam vulnerabilities
It was discovered that the PAM pam_userdb module incorrectly used a case-insensitive method when comparing hashed passwords. A local attacker could possibly use this issue to make brute force attacks easier. This issue only affected Ubuntu 12.04 LTS and Ubunt…
first Mar 16, 2016 -
UnscoredUSN-2987-1 5 CVEs
libgd2 vulnerabilities
It was discovered that the GD library incorrectly handled certain color tables in XPM images. If a user or automated system were tricked into processing a specially crafted XPM image, an attacker could cause a denial of service. This issue only affected Ubunt…
first May 31, 2016 -
UnscoredUSN-2985-2 0 CVEs
eglibc, glibc regression
USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for CVE-2014-9761 introduced a regression which affected applications that use the libm library but were not fully restarted after the upgrade. This update removes the fix for CVE-2014-9761 and a …
first May 26, 2016 -
UnscoredUSN-2957-1 1 CVE
libtasn1-3, libtasn1-6 vulnerability
Pascal Cuoq and Miod Vallat discovered that Libtasn1 incorrectly handled certain malformed DER certificates. A remote attacker could possibly use this issue to cause applications using Libtasn1 to hang, resulting in a denial of service.
first May 2, 2016 -
UnscoredUSN-2950-2 0 CVEs
libsoup2.4 update
USN-2950-1 fixed vulnerabilities in Samba. The updated Samba packages introduced a compatibility issue with NTLM authentication in libsoup. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jouni Knuutinen discovere…
first May 4, 2016 -
UnscoredUSN-2925-1 2 CVEs
bind9 vulnerabilities
It was discovered that Bind incorrectly handled input received by the rndc control channel. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2016-1285) It was discovered that Bind incorrectly parse…
first Mar 9, 2016 -
UnscoredUSN-2965-1 15 CVEs
linux vulnerabilities
Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel did not properly reference count file descriptors, leading to a use-after-free. A local unprivileged attacker could use this to gain administrative privile…
first May 6, 2016 -
UnscoredUSN-2959-1 5 CVEs
openssl vulnerabilities
Huzaifa Sidhpurwala, Hanno Böck, and David Benjamin discovered that OpenSSL incorrectly handled memory when decoding ASN.1 structures. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbi…
first May 3, 2016 -
UnscoredUSN-2950-3 0 CVEs
samba regressions
USN-2950-1 fixed vulnerabilities in Samba. The fixes introduced in Samba 4.3.8 caused certain regressions and interoperability issues. This update resolves some of these issues by updating to Samba 4.3.9 in Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS.…
first May 4, 2016 -
UnscoredUSN-2968-1 15 CVEs
linux vulnerabilities
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly validate the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). (CVE-2015-7515) Ben Hawkes…
first May 9, 2016 -
UnscoredUSN-2958-1 3 CVEs
poppler vulnerabilities
It was discovered that the poppler pdfseparate tool incorrectly handled certain filenames. A local attacker could use this issue to cause the tool to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubunt…
first May 2, 2016 -
UnscoredUSN-2982-1 6 CVEs
libksba vulnerabilities
Hanno Böck discovered that Libksba incorrectly handled decoding certain BER data. An attacker could use this issue to cause Libksba to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-4353) H…
first May 17, 2016 -
UnscoredUSN-2957-2 1 CVE
libtasn1-6 vulnerability
USN-2957-1 fixed a vulnerability in Libtasn1. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: Pascal Cuoq and Miod Vallat discovered that Libtasn1 incorrectly handled certain malformed DER certificates. A remote …
first May 2, 2016 -
UnscoredUSN-2943-1 25 CVEs
pcre3 vulnerabilities
It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 29, 2016 -
UnscoredUSN-2973-1 5 CVEs
thunderbird vulnerabilities
Christian Holler, Tyson Smith, and Phil Ringalda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via applicatio…
first May 19, 2016 -
UnscoredUSN-2939-1 6 CVEs
tiff vulnerabilities
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute …
first Mar 23, 2016 -
UnscoredUSN-2946-1 4 CVEs
linux vulnerabilities
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux kernel's CXGB3 driver. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2015-8812) Xiaofei Rex Guo discovered a timing …
first Apr 6, 2016 -
UnscoredUSN-2934-1 23 CVEs
thunderbird vulnerabilities
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could pote…
first Apr 27, 2016 -
UnscoredUSN-3169-1 3 CVEs
linux vulnerabilities
Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly initialize the Code Segment (CS) in certain error cases. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2016-9756) Andrey Konovalo…
first Jan 11, 2017 -
UnscoredUSN-2927-1 14 CVEs
graphite2 vulnerabilities
It was discovered that graphite2 incorrectly handled certain malformed fonts. If a user or automated system were tricked into opening a specially- crafted font file, a remote attacker could use this issue to cause graphite2 to crash, resulting in a denial of …
first Mar 14, 2016 -
High max 8.8
oxide-qt vulnerabilities
A use-after-free was discovered when responding synchronously to permission requests. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program…
first Apr 27, 2016 -
UnscoredUSN-2937-1 27 CVEs
webkitgtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …
first Mar 21, 2016