8,464 results · Feed
-
UnscoredUSN-2924-1 1 CVE
nss vulnerability
Francis Gabriel discovered that NSS incorrectly handled decoding certain ASN.1 data. An remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 9, 2016 -
UnscoredUSN-2920-1 13 CVEs
oxide-qt vulnerabilities
It was discovered that the ContainerNode::parserRemoveChild function in Blink mishandled widget updates in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin r…
first Mar 10, 2016 -
UnscoredUSN-2922-1 2 CVEs
samba vulnerabilities
Jeremy Allison discovered that Samba incorrectly handled ACLs on symlink paths. A remote attacker could use this issue to overwrite the ownership of ACLs using symlinks. (CVE-2015-7560) Garming Sam and Douglas Bagnall discovered that the Samba internal DNS se…
first Mar 8, 2016 -
UnscoredUSN-2919-1 2 CVEs
jasper vulnerabilities
Jacob Baines discovered that JasPer incorrectly handled ICC color profiles in JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code…
first Mar 3, 2016 -
UnscoredUSN-2933-1 2 CVEs
exim4 vulnerabilities
It was discovered that Exim incorrectly filtered environment variables when used with the perl_startup configuration option. If the perl_startup option was enabled, a local attacker could use this issue to escalate their privileges to the root user. This issu…
first Mar 15, 2016 -
UnscoredUSN-2929-1 14 CVEs
linux vulnerabilities
Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when handling IPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary …
first Mar 14, 2016 -
UnscoredUSN-2917-1 34 CVEs
firefox vulnerabilities
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary co…
first Mar 9, 2016 -
UnscoredUSN-2914-1 5 CVEs
openssl vulnerabilities
Yuval Yarom, Daniel Genkin, and Nadia Heninger discovered that OpenSSL was vulnerable to a side-channel attack on modular exponentiation. On certain CPUs, a local attacker could possibly use this issue to recover RSA keys. This flaw is known as CacheBleed. (C…
first Mar 1, 2016 -
UnscoredUSN-2917-2 0 CVEs
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several regressions that could result in search engine settings being lost, the list of search providers appearing empty or the location bar breaking after typing an invalid URL. This update fixe…
first Apr 7, 2016 -
UnscoredUSN-2917-3 0 CVEs
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several web compatibility regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Francis Gabriel discovered a buffer overflow during ASN.1 deco…
first Apr 19, 2016 -
UnscoredUSN-2913-3 0 CVEs
openssl update
USN-2913-1 removed 1024-bit RSA CA certificates from the ca-certificates package. This update adds support for alternate certificate chains to the OpenSSL package to properly handle the removal. Original advisory details: The ca-certificates package contained…
first Feb 24, 2016 -
UnscoredUSN-2904-1 4 CVEs
thunderbird vulnerabilities
Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information. (CVE…
first Mar 8, 2016 -
UnscoredUSN-2912-1 2 CVEs
libssh vulnerabilities
Mariusz Ziulek discovered that libssh incorrectly handled certain packets. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2015-3146) Aris Adamantiadis discovered that libssh incorrectly generat…
first Feb 23, 2016 -
UnscoredUSN-2907-1 7 CVEs
linux vulnerabilities
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged attacker could use this to gain privileges. (CVE-2016-1576) halfdog discovered that OverlayFS in the Linux …
first Feb 22, 2016 -
UnscoredUSN-2918-1 1 CVE
pixman vulnerability
Vincent LE GARREC discovered an integer underflow in pixman. If a user were tricked into opening a specially crafted file, a remote attacker could cause pixman to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 3, 2016 -
UnscoredUSN-2916-1 3 CVEs
perl vulnerabilities
It was discovered that Perl incorrectly handled certain regular expressions with an invalid backreference. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-7422) Markus Ve…
first Mar 2, 2016 -
UnscoredUSN-2902-1 4 CVEs
graphite2 vulnerabilities
Yves Younan discovered that graphite2 incorrectly handled certain malformed fonts. If a user or automated system were tricked into opening a specially- crafted font file, a remote attacker could use this issue to cause graphite2 to crash, resulting in a denia…
first Feb 17, 2016 -
UnscoredUSN-2899-1 2 CVEs
libreoffice vulnerabilities
It was discovered that LibreOffice incorrectly handled LWP document files. If a user were tricked into opening a specially crafted LWP document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code.
first Feb 16, 2016 -
UnscoredUSN-2893-1 1 CVE
firefox vulnerability
Jason Pang discovered that service workers intercept responses to plugin network requests made through the browser. An attacker could potentially exploit this to bypass same origin restrictions using the Flash plugin. (CVE-2016-1949)
first Feb 11, 2016 -
UnscoredUSN-2903-1 1 CVE
nss vulnerability
Hanno Böck discovered that NSS incorrectly handled certain division functions, possibly leading to cryptographic weaknesses. (CVE-2016-1938) This update also refreshes the NSS package to version 3.21 which includes the latest CA certificate bundle, and remove…
first Feb 17, 2016 -
UnscoredUSN-2894-1 2 CVEs
postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities
It was discovered that PostgreSQL incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. (CVE-2016-0773) It was discovered that PostgreSQL incorrectly ha…
first Feb 11, 2016 -
UnscoredUSN-2900-1 1 CVE
eglibc, glibc vulnerability
It was discovered that the GNU C Library incorrectly handled receiving responses while performing DNS resolution. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Feb 16, 2016 -
UnscoredUSN-2870-1 1 CVE
linux vulnerability
Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbi…
first Jan 19, 2016 -
UnscoredUSN-2880-2 0 CVEs
firefox regression
USN-2880-1 fixed vulnerabilities in Firefox. This update introduced a regression which caused Firefox to crash on startup with some configurations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Bob Clary, Christ…
first Feb 8, 2016 -
UnscoredUSN-2913-4 0 CVEs
gnutls26 update
USN-2913-1 removed 1024-bit RSA CA certificates from the ca-certificates package. This update adds support for alternate certificate chains to the GnuTLS package to properly handle the removal. Original advisory details: The ca-certificates package contained …
first Feb 24, 2016 -
UnscoredUSN-2874-1 1 CVE
bind9 vulnerability
It was discovered that Bind incorrectly handled certain APL data. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
first Jan 19, 2016 -
UnscoredUSN-2896-1 1 CVE
libgcrypt11, libgcrypt20 vulnerability
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys.
first Feb 15, 2016 -
UnscoredUSN-2880-1 12 CVEs
firefox vulnerabilities
Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman, Carsten Book, Randell Jesup, Nicolas Pierron, Eric Rescorla, Tyson Smith, and Gabor Krizsanits discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a …
first Jan 27, 2016 -
UnscoredUSN-2864-1 1 CVE
nss vulnerability
Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information.
first Jan 7, 2016 -
UnscoredUSN-4165-2 0 CVEs
firefox regressions
USN-4165-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tr…
first Nov 5, 2019 -
UnscoredUSN-2855-1 7 CVEs
samba vulnerabilities
Thilo Uttendorfer discovered that the Samba LDAP server incorrectly handled certain packets. A remote attacker could use this issue to cause the LDAP server to stop responding, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubunt…
first Jan 5, 2016 -
UnscoredUSN-2867-1 4 CVEs
libvirt vulnerabilities
It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon was restarted. This could result in an unintended firewall configuration. This issue only applied to Ubuntu 12.04 LTS. (CVE-2011-4600) Peter Krempa discov…
first Jan 12, 2016 -
UnscoredUSN-2868-1 1 CVE
isc-dhcp vulnerability
Sebastian Poehn discovered that the DHCP server, client, and relay incorrectly handled certain malformed UDP packets. A remote attacker could use this issue to cause the DHCP server, client, or relay to stop responding, resulting in a denial of service.
first Jan 13, 2016 -
UnscoredUSN-2887-1 4 CVEs
linux vulnerabilities
It was discovered that a use-after-free vulnerability existed in the AF_UNIX implementation in the Linux kernel. A local attacker could use crafted epoll_ctl calls to cause a denial of service (system crash) or expose sensitive information. (CVE-2013-7446) It…
first Feb 2, 2016 -
UnscoredUSN-2882-1 1 CVE
curl vulnerability
Isaac Boukris discovered that curl could incorrectly re-use NTLM proxy credentials when subsequently connecting to the same host.
first Jan 27, 2016 -
UnscoredUSN-2897-1 3 CVEs
nettle vulnerabilities
Hanno Böck discovered that Nettle incorrectly handled carry propagation in the NIST P-256 elliptic curve. (CVE-2015-8803) Hanno Böck discovered that Nettle incorrectly handled carry propagation in the NIST P-384 elliptic curve. (CVE-2015-8804) Niels Moeller d…
first Feb 15, 2016 -
UnscoredUSN-2865-1 1 CVE
gnutls26, gnutls28 vulnerability
Karthikeyan Bhargavan and Gaetan Leurent discovered that GnuTLS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information.
first Jan 8, 2016 -
UnscoredUSN-2875-1 2 CVEs
libxml2 vulnerabilities
It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service.
first Jan 19, 2016 -
UnscoredUSN-2876-1 1 CVE
ecryptfs-utils vulnerability
Jann Horn discovered that mount.ecryptfs_private would mount over certain directories in the proc filesystem. A local attacker could use this to escalate their privileges. (CVE-2016-1572)
first Jan 20, 2016 -
UnscoredUSN-2855-2 0 CVEs
samba regression
USN-2855-1 fixed vulnerabilities in Samba. The upstream fix for CVE-2015-5252 introduced a regression in certain specific environments. This update fixes the problem. Original advisory details: Thilo Uttendorfer discovered that the Samba LDAP server incorrect…
first Feb 16, 2016