8,464 results · Feed
-
UnscoredUSN-2360-1 1 CVE
firefox vulnerabilities
Antoine Delignat-Lavaud and others discovered that NSS incorrectly handled parsing ASN.1 values. An attacker could use this issue to forge RSA certificates.
first Sep 24, 2014 -
UnscoredUSN-2384-1 20 CVEs
mysql-5.5 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to 5.5.40. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly in…
first Oct 15, 2014 -
UnscoredUSN-2370-1 1 CVE
apt vulnerability
Guillem Jover discovered that APT incorrectly created a temporary file when handling the changelog command. A local attacker could use this issue to overwrite arbitrary files. In the default installation of Ubuntu, this should be prevented by the kernel link …
first Oct 8, 2014 -
UnscoredUSN-2359-1 4 CVEs
linux vulnerabilities
Jack Morgenstein reported a flaw in the page handling of the KVM (Kerenl Virtual Machine) subsystem in the Linux kernel. A guest OS user could exploit this flaw to cause a denial of service (host OS memory corruption) or possibly have other unspecified impact…
first Sep 23, 2014 -
UnscoredUSN-2361-1 1 CVE
nss vulnerability
Antoine Delignat-Lavaud and others discovered that NSS incorrectly handled parsing ASN.1 values. An attacker could use this issue to forge RSA certificates.
first Sep 24, 2014 -
UnscoredUSN-2372-1 12 CVEs
firefox vulnerabilities
Bobby Holley, Christian Holler, David Bolter, Byron Campen, Jon Coppeard, Carsten Book, Martijn Wargers, Shih-Chiang Chien, Terrence Cole and Jeff Walden discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially cra…
first Oct 14, 2014 -
UnscoredUSN-2352-1 5 CVEs
dbus vulnerabilities
Simon McVittie discovered that DBus incorrectly handled the file descriptors message limit. A local attacker could use this issue to cause DBus to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 1…
first Sep 22, 2014 -
UnscoredUSN-2350-1 0 CVEs
nss update
The NSS package contained outdated CA certificates. This update refreshes the NSS package to version 3.17 which includes the latest CA certificate bundle.
first Sep 22, 2014 -
UnscoredUSN-2353-1 1 CVE
apt vulnerability
It was discovered that APT incorrectly handled certain http URLs. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to cause APT to crash, resulting in a denial of service, or possibly execute arbitrary cod…
first Sep 23, 2014 -
UnscoredUSN-2346-1 2 CVEs
curl vulnerabilities
Tim Ruehsen discovered that curl incorrectly handled partial literal IP addresses. This could lead to the disclosure of cookies to the wrong site, and malicious sites being able to set cookies for others. (CVE-2014-3613) Tim Ruehsen discovered that curl incor…
first Sep 15, 2014 -
UnscoredUSN-2344-1 2 CVEs
php5 vulnerabilities
It was discovered that the Fileinfo component in php5 contains an integer overflow. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code via a crafted CDF file. (CVE-2014-3587) It was discovered that the php_parserr …
first Sep 10, 2014 -
UnscoredUSN-2348-1 4 CVEs
apt vulnerabilities
It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. (CVE-2014-0487) It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to an authenticated state. (CVE-2014-04…
first Sep 16, 2014 -
UnscoredUSN-2341-1 3 CVEs
cups vulnerabilities
Salvatore Bonaccorso discovered that the CUPS web interface incorrectly validated permissions and incorrectly handled symlinks. An attacker could possibly use this issue to bypass file permissions and read arbitrary files, possibly leading to a privilege esca…
first Sep 8, 2014 -
UnscoredUSN-2328-1 1 CVE
eglibc vulnerability
Tavis Ormandy and John Haxby discovered that the GNU C Library contained an off-by-one error when performing transliteration module loading. A local attacker could exploit this to gain administrative privileges. (CVE-2014-5119) USN-2306-1 fixed vulnerabilitie…
first Aug 29, 2014 -
UnscoredUSN-2338-1 1 CVE
lua5.1 vulnerability
It was discovered that Lua incorrectly handled certain vararg functions with a large number of fixed parameters. An attacker could use this issue to cause Lua applications to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Sep 3, 2014 -
UnscoredUSN-2318-1 2 CVEs
linux vulnerabilities
Eric W. Biederman discovered a flaw with the mediation of mount flags in the Linux kernel's user namespace subsystem. An unprivileged user could exploit this flaw to by-pass mount restrictions, and potentially gain administrative privileges. (CVE-2014-5207) K…
first Aug 18, 2014 -
UnscoredUSN-2343-1 1 CVE
nss vulnerability
Tyson Smith and Jesse Schwartzentruber discovered that NSS contained a race condition when performing certificate validation. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Sep 9, 2014 -
UnscoredUSN-3880-1 4 CVEs
linux vulnerabilities
It was discovered that the CIFS client implementation in the Linux kernel did not properly handle setup negotiation during session recovery, leading to a NULL pointer exception. An attacker could use this to create a malicious CIFS server that caused a denial…
first Feb 4, 2019 -
UnscoredUSN-2339-2 1 CVE
libgcrypt11 vulnerability
Daniel Genkin, Adi Shamir, and Eran Tromer discovered that Libgcrypt was susceptible to an adaptive chosen ciphertext attack via physical side channels. A local attacker could use this attack to possibly recover private keys.
first Sep 3, 2014 -
UnscoredUSN-2304-1 1 CVE
kde4libs vulnerability
It was discovered that kauth was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations.
first Jul 31, 2014 -
UnscoredUSN-2316-1 3 CVEs
subversion vulnerabilities
Lieven Govaerts discovered that the Subversion mod_dav_svn module incorrectly handled certain request methods when SVNListParentPath was enabled. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. This issue…
first Aug 14, 2014 -
UnscoredUSN-2331-1 1 CVE
libreoffice vulnerability
Rohan Durve and James Kettle discovered LibreOffice Calc sometimes allowed for command injection when opening spreadsheets. If a user were tricked into opening a crafted Calc spreadsheet, an attacker could exploit this to run programs as your login.
first Sep 2, 2014 -
UnscoredUSN-2308-1 9 CVEs
openssl vulnerabilities
Adam Langley and Wan-Teh Chang discovered that OpenSSL incorrectly handled certain DTLS packets. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2014-3505) Adam Langley discovered that OpenSSL incorrect…
first Aug 7, 2014 -
UnscoredUSN-2337-1 14 CVEs
linux vulnerabilities
A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq). A guest OS user could exploit this flaw to cause a denial of service (host OS crash). (CVE-2014-0155) Andy Lutomirski discovered a flaw in the authorizat…
first Sep 2, 2014 -
UnscoredUSN-2307-1 1 CVE
gpgme1.0 vulnerability
Tomáš Trnka discovered that GPGME incorrectly handled certain certificate line lengths. An attacker could use this issue to cause applications using GPGME to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Aug 6, 2014 -
UnscoredUSN-2310-1 9 CVEs
krb5 vulnerabilities
It was discovered that Kerberos incorrectly handled certain crafted Draft 9 requests. A remote attacker could use this issue to cause the daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-1016) It was disc…
first Aug 11, 2014 -
UnscoredUSN-2330-1 6 CVEs
thunderbird vulnerabilities
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman and JW Wang discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker…
first Sep 11, 2014 -
UnscoredUSN-2329-1 7 CVEs
firefox vulnerabilities
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman, JW Wang and David Weir discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentia…
first Sep 2, 2014 -
UnscoredUSN-2303-1 0 CVEs
unity vulnerability
It was discovered that in certain circumstances Unity failed to successfully grab the keyboard when switching to the lock screen. A local attacker could possibly use this issue to run commands, and unlock the current session.
first Jul 31, 2014 -
UnscoredUSN-2315-1 1 CVE
serf vulnerability
Ben Reser discovered that serf did not correctly handle SSL certificates with NUL bytes in the CommonName or SubjectAltNames fields. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypte…
first Aug 14, 2014 -
UnscoredUSN-2314-1 1 CVE
linux vulnerability
An flaw was discovered in the Linux kernel's audit subsystem when auditing certain syscalls. A local attacker could exploit this flaw to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS).
first Aug 13, 2014 -
UnscoredUSN-2305-1 1 CVE
samba vulnerability
Volker Lendecke discovered that the Samba NetBIOS name service daemon incorrectly handled certain memory operations. A remote attacker could use this issue to execute arbitrary code as the root user.
first Aug 1, 2014 -
UnscoredUSN-2293-1 1 CVE
cups vulnerability
Francisco Alonso discovered that the CUPS web interface incorrectly validated permissions on rss files. A local attacker could possibly use this issue to bypass file permissions and read arbitrary files, possibly leading to a privilege escalation.
first Jul 21, 2014 -
UnscoredUSN-2294-1 3 CVEs
libtasn1-3, libtasn1-6 vulnerabilities
It was discovered that Libtasn1 incorrectly handled certain ASN.1 data structures. An attacker could exploit this with specially crafted ASN.1 data and cause applications using Libtasn1 to crash, resulting in a denial of service. (CVE-2014-3467) It was discov…
first Jul 22, 2014 -
UnscoredUSN-2295-1 13 CVEs
firefox vulnerabilities
Christian Holler, David Keeler, Byron Campen, Gary Kwong, Jesse Ruderman, Andrew McCreight, Alon Zakai, Bobby Holley, Jonathan Watt, Shu-yu Guo, Steve Fink, Terrence Cole, Gijs Kruitbosch and Cătălin Badea discovered multiple memory safety issues in Firefox. …
first Jul 22, 2014 -
UnscoredUSN-2299-1 4 CVEs
apache2 vulnerabilities
Marek Kroemeke discovered that the mod_proxy module incorrectly handled certain requests. A remote attacker could use this issue to cause the server to stop responding, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0117)…
first Jul 23, 2014 -
UnscoredUSN-2296-1 11 CVEs
thunderbird vulnerabilities
Christian Holler, David Keeler and Byron Campen discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of …
first Jul 22, 2014 -
Medium max 4.0USN-2275-1 3 CVEs
dbus vulnerabilities
Alban Crequy discovered that dbus-daemon incorrectly sent AccessDenied errors to the service instead of the client when enforcing permissions. A local user can use this issue to possibly deny access to the service. (CVE-2014-3477) Alban Crequy discovered that…
first Jul 8, 2014 -
UnscoredUSN-2291-1 4 CVEs
mysql-5.5 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to 5.5.38. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly in…
first Jul 17, 2014 -
Medium max 6.5USN-2278-1 7 CVEs
file vulnerabilities
Mike Frysinger discovered that the file awk script detector used multiple wildcard with unlimited repetitions. An attacker could use this issue to cause file to consume resources, resulting in a denial of service. (CVE-2013-7345) Francisco Alonso discovered t…
first Jul 15, 2014