8,464 results · Feed
-
UnscoredUSN-2460-1 3 CVEs
thunderbird vulnerabilities
Christian Holler and Patrick McManus discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via…
first Jan 19, 2015 -
UnscoredUSN-2459-1 7 CVEs
openssl vulnerabilities
Pieter Wuille discovered that OpenSSL incorrectly handled Bignum squaring. (CVE-2014-3570) Markus Stenberg discovered that OpenSSL incorrectly handled certain crafted DTLS messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting i…
first Jan 12, 2015 -
UnscoredUSN-2466-1 4 CVEs
linux vulnerabilities
A null pointer dereference flaw was discovered in the the Linux kernel's SCTP implementation when ASCONF is used. A remote attacker could exploit this flaw to cause a denial of service (system crash) via a malformed INIT chunk. (CVE-2014-7841) A race conditio…
first Jan 13, 2015 -
UnscoredUSN-2458-3 0 CVEs
firefox regression
USN-2458-1 fixed vulnerabilities in Firefox. This update introduced a regression which could make websites that use CSP fail to load under some circumstances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Christ…
first Jan 27, 2015 -
UnscoredUSN-2446-1 9 CVEs
linux vulnerabilities
Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack Segment (SS) register in the x86 architecture. A local attacker could exploit this flaw to gain administrative privileges. (CVE-2014-9322) An informatio…
first Dec 12, 2014 -
UnscoredUSN-2435-1 1 CVE
graphviz vulnerability
It was discovered that graphviz incorrectly handled parsing errors. An attacker could use this issue to cause graphviz to crash or possibly execute arbitrary code.
first Dec 9, 2014 -
UnscoredUSN-2451-1 1 CVE
cgmanager vulnerability
Serge Hallyn discovered that cgmanager did not consistently enforce proper nesting when modifying cgroup properties. A local attacker in a privileged container could use this to set cgroup values for all cgroups.
first Jan 6, 2015 -
UnscoredUSN-2429-1 1 CVE
ppp vulnerability
It was discovered that ppp incorrectly handled certain options files. A local attacker could possibly use this issue to escalate privileges.
first Dec 1, 2014 -
UnscoredUSN-2452-1 1 CVE
nss vulnerability
It was discovered that NSS incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack.
first Jan 7, 2015 -
UnscoredUSN-2437-1 1 CVE
bind9 vulnerability
Florian Maury discovered that Bind incorrectly handled delegation. A remote attacker could possibly use this issue to cause Bind to consume resources and crash, resulting in a denial of service.
first Dec 9, 2014 -
UnscoredUSN-2436-2 0 CVEs
xorg-server, xorg-server-lts-trusty vulnerabilities
USN-2436-1 fixed vulnerabilities in the X.Org X server. Since publication, additional fixes have been made available for these issues. This update adds the additional fixes. Original advisory details: Ilja van Sprundel discovered a multitude of security issue…
first Dec 10, 2014 -
UnscoredUSN-2458-1 9 CVEs
firefox vulnerabilities
Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker c…
first Jan 14, 2015 -
UnscoredUSN-2438-1 3 CVEs
nvidia-graphics-drivers-304, nvidia-graphics-drivers-304-updates, nvidia-graphics-drivers-331, nvidia-graphics-drivers-331-updates vulnerabilities
It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resu…
first Dec 10, 2014 -
UnscoredUSN-2399-1 1 CVE
curl vulnerability
Symeon Paraschoudis discovered that curl incorrectly handled memory when being used with CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle(). This may result in sensitive data being incorrectly sent to the remote server.
first Nov 10, 2014 -
UnscoredUSN-2428-1 5 CVEs
thunderbird vulnerabilities
Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, and Max Jonas Werner discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially expl…
first Dec 3, 2014 -
UnscoredUSN-2366-1 3 CVEs
libvirt vulnerabilities
Daniel P. Berrange and Richard Jones discovered that libvirt incorrectly handled XML documents containing XML external entity declarations. An attacker could use this issue to cause libvirtd to crash, resulting in a denial of service on all affected releases,…
first Sep 30, 2014 -
UnscoredUSN-2369-1 1 CVE
file vulnerability
It was discovered that file incorrectly handled certain CDF documents. A attacker could use this issue to cause file to hang or crash, resulting in a denial of service.
first Oct 3, 2014 -
High max 7.3USN-2420-1 4 CVEs
linux vulnerabilities
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual Machine) subsystem handles the CR4 control register at VM entry on Intel processors. A local host OS user can exploit this to cause a denial of service (kill arbitrary processes, or system di…
first Nov 25, 2014 -
UnscoredUSN-2398-1 1 CVE
libreoffice vulnerability
It was discovered that LibreOffice incorrectly handled the Impress remote control port. An attacker could possibly use this issue to cause Impress to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 5, 2014 -
UnscoredUSN-3168-1 4 CVEs
linux vulnerabilities
Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly initialize the Code Segment (CS) in certain error cases. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2016-9756) Andrey Konovalo…
first Jan 11, 2017 -
UnscoredUSN-2427-1 1 CVE
libksba vulnerability
Hanno Böck discovered that Libksba incorrectly handled certain S/MIME messages or ECC based OpenPGP data. An attacker could use this issue to cause Libksba to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 27, 2014 -
UnscoredUSN-2413-1 1 CVE
apparmor vulnerability
An AppArmor policy miscompilation flaw was discovered in apparmor_parser. Under certain circumstances, a malicious application could use this flaw to perform operations that are not allowed by AppArmor policy. The flaw may also prevent applications from acces…
first Nov 20, 2014 -
UnscoredUSN-2424-1 8 CVEs
firefox vulnerabilities
Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Christian Holler, Jon Coppeard, Eric Rahm, Byron Campen, Eric Rescorla, and Xidorn Quan discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a spe…
first Dec 2, 2014 -
UnscoredUSN-2395-1 6 CVEs
linux vulnerabilities
Nadav Amit reported that the KVM (Kernel Virtual Machine) mishandles noncanonical addresses when emulating instructions that change the rip (Instruction Pointer). A guest user with access to I/O or the MMIO can use this flaw to cause a denial of service (syst…
first Oct 30, 2014 -
UnscoredUSN-2404-1 2 CVEs
libvirt vulnerabilities
Pavel Hrdina discovered that libvirt incorrectly handled locking when processing the virConnectListAllDomains command. An attacker could use this issue to cause libvirtd to hang, resulting in a denial of service. (CVE-2014-3657) Eric Blake discovered that lib…
first Nov 11, 2014 -
UnscoredUSN-2434-1 1 CVE
jasper vulnerability
Jose Duart discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code with …
first Dec 8, 2014 -
UnscoredUSN-2432-1 3 CVEs
eglibc, glibc vulnerabilities
Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled certain multibyte characters when using the iconv function. An attacker could possibly use this issue to cause applications to crash, resulting in a denial of service. This issue only af…
first Dec 3, 2014 -
UnscoredUSN-2412-1 1 CVE
ruby1.8, ruby1.9.1, ruby2.0, ruby2.1 vulnerability
Tomas Hoger discovered that Ruby incorrectly handled XML entity expansion. An attacker could use this flaw to cause Ruby to consume large amounts of resources, resulting in a denial of service.
first Nov 20, 2014 -
UnscoredUSN-2373-1 7 CVEs
thunderbird vulnerabilities
Bobby Holley, Christian Holler, David Bolter, Byron Campen and Jon Coppeard discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit…
first Oct 15, 2014 -
UnscoredUSN-2389-1 1 CVE
libxml2 vulnerability
It was discovered that libxml2 would incorrectly perform entity substitution even when requested not to. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in …
first Oct 27, 2014 -
UnscoredUSN-2425-1 1 CVE
dbus vulnerability
It was discovered that DBus incorrectly handled a large number of file descriptor messages. A local attacker could use this issue to cause DBus to stop responding, resulting in a denial of service. (CVE-2014-7824)
first Nov 27, 2014 -
UnscoredUSN-2379-1 9 CVEs
linux vulnerabilities
Steven Vittitoe reported multiple stack buffer overflows in Linux kernel's magicmouse HID driver. A physically proximate attacker could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code via specially crafted devi…
first Oct 9, 2014 -
UnscoredUSN-2397-1 2 CVEs
ruby1.8, ruby1.9.1, ruby2.0, ruby2.1 vulnerabilities
Will Wood discovered that Ruby incorrectly handled the encodes() function. An attacker could possibly use this issue to cause Ruby to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releas…
first Nov 4, 2014 -
UnscoredUSN-2385-1 2 CVEs
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled memory when parsing DTLS SRTP extension data. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS…
first Oct 16, 2014 -
UnscoredUSN-2390-1 4 CVEs
pidgin vulnerabilities
Jacob Appelbaum and an anonymous person discovered that Pidgin incorrectly handled certificate validation. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications. (CVE-201…
first Oct 28, 2014 -
UnscoredUSN-2436-1 13 CVEs
xorg-server, xorg-server-lts-trusty vulnerabilities
Ilja van Sprundel discovered a multitude of security issues in the X.Org X server. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible pr…
first Dec 9, 2014 -
UnscoredUSN-2423-1 2 CVEs
clamav vulnerabilities
Kurt Seifried discovered that ClamAV incorrectly handled certain JavaScript files. An attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-6497) Damien Millescamp disc…
first Nov 26, 2014 -
UnscoredUSN-2426-1 2 CVEs
flac vulnerabilities
Michele Spagnuolo discovered that FLAC incorrectly handled certain malformed audio files. An attacker could use this issue to cause FLAC to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 27, 2014 -
UnscoredUSN-2391-1 4 CVEs
php5 vulnerabilities
Symeon Paraschoudis discovered that PHP incorrectly handled the mkgmtime function. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2014-3668) Symeon Paraschoudis discovered that PHP incorrectly han…
first Oct 30, 2014 -
UnscoredUSN-2360-2 1 CVE
thunderbird vulnerabilities
USN-2360-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Thunderbird. Original advisory details: Antoine Delignat-Lavaud and others discovered that NSS incorrectly handled parsing ASN.1 values. An attacker could use this…
first Sep 24, 2014