8,464 results · Feed
-
High max 8.1USN-7058-1 4 CVEs
dotnet6, dotnet8 vulnerabilities
Brennan Conroy discovered that the .NET Kestrel web server did not properly handle closing HTTP/3 streams under certain circumstances. An attacker could possibly use this issue to achieve remote code execution. This vulnerability only impacted .NET8. (CVE-202…
first Oct 8, 2024 -
UnscoredUSN-7054-1 1 CVE
unzip vulnerability
It was discovered that unzip did not properly handle unicode strings under certain circumstances. If a user were tricked into opening a specially crafted zip file, an attacker could possibly use this issue to cause unzip to crash, resulting in a denial of ser…
first Oct 3, 2024 -
Medium max 5.3USN-7042-2 1 CVE
cups-browsed vulnerability
USN-7042-1 fixed a vulnerability in cups-browsed. This update improves the fix by removing support for the legacy CUPS printer discovery protocol entirely. Original advisory details: Simone Margaritelli discovered that cups-browsed could be used to create arb…
first Oct 9, 2024 -
Medium max 5.3USN-7042-1 1 CVE
cups-browsed vulnerability
Simone Margaritelli discovered that cups-browsed could be used to create arbitrary printers from outside the local network. In combination with issues in other printing components, a remote attacker could possibly use this issue to connect to a system, create…
first Sep 26, 2024 -
Critical max 10.0USN-7036-1 10 CVEs
ruby-rack vulnerabilities
It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a user or automated system were tricked into sending a specially crafted multipart POST request to an application using Rack, a remote attacker could possibl…
first Sep 26, 2024 -
UnscoredUSN-7034-1 0 CVEs
ca-certificates update
The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.64 version of the Mozilla certificate authority bundle.
first Sep 25, 2024 -
Critical max 9.1USN-7030-1 1 CVE
py7zr vulnerability
It was discovered that py7zr was vulnerable to path traversal attacks. If a user or automated system were tricked into extracting a specially crafted 7z archive, an attacker could possibly use this issue to write arbitrary files outside the target directory o…
first Sep 24, 2024 -
Critical max 9.8USN-7017-1 1 CVE
quagga vulnerability
Iggy Frankovic discovered that Quagga incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service.
first Sep 17, 2024 -
Critical max 9.8USN-7016-1 1 CVE
frr vulnerability
Iggy Frankovic discovered that FRR incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service.
first Sep 17, 2024 -
High max 8.3USN-6988-2 1 CVE
twisted vulnerability
USN-6988-1 fixed CVE-2024-41671 in Twisted. The USN incorrectly stated that previous releases were unaffected. This update provides the equivalent fix for Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: Ben Kallus discover…
first Nov 26, 2024 -
Medium max 6.0USN-6977-1 2 CVEs
qemu vulnerabilities
It was discovered that QEMU did not properly handle certain memory operations, which could result in a buffer overflow. An attacker could potentially use this issue to cause a denial of service. (CVE-2024-26327) It was discovered that QEMU did not properly ha…
first Aug 22, 2024 -
UnscoredUSN-6970-1 1 CVE
exfatprogs vulnerability
It was discovered that exfatprogs incorrectly handled certain memory operations. If a user or automated system were tricked into handling specially crafted exfat partitions, a remote attacker could use this issue to cause exfatprogs to crash, resulting in a d…
first Aug 20, 2024 -
Medium max 6.5USN-6963-1 1 CVE
gnome-shell vulnerability
It was discovered that GNOME Shell incorrectly opened the portal helper automatically when detecting a captive network portal. A remote attacker could possibly use this issue to load arbitrary web pages containing JavaScript, leading to resource consumption o…
first Aug 15, 2024 -
Medium max 6.5USN-6959-1 1 CVE
dotnet8 vulnerability
It was discovered that .NET suffered from an information disclosure vulnerability. An attacker could potentially use this issue to read targeted email messages.
first Aug 13, 2024 -
High max 8.8USN-6954-1 3 CVEs
qemu vulnerabilities
Markus Frank and Fiona Ebner discovered that QEMU did not properly handle certain memory operations, leading to a NULL pointer dereference. An authenticated user could potentially use this issue to cause a denial of service. (CVE-2023-6683) Xiao Lei discovere…
first Aug 13, 2024 -
Medium max 6.3USN-6940-1 3 CVEs
snapd vulnerabilities
Neil McPhail discovered that snapd did not properly restrict writes to the $HOME/bin path in the AppArmor profile for snaps using the home plug. An attacker who could convince a user to install a malicious snap could use this vulnerability to escape the snap …
first Aug 1, 2024 -
UnscoredUSN-6933-1 3 CVEs
clickhouse vulnerabilities
It was discovered that ClickHouse incorrectly handled memory, leading to a heap out-of-bounds data read. An attacker could possibly use this issue to cause a denial of service, or leak sensitive information. (CVE-2021-42387, CVE-2021-41388) It was discovered …
first Jul 31, 2024 -
High max 8.0USN-6914-1 1 CVE
ocsinventory-server vulnerability
Filip Hejsek discovered that the phpCAS library included in OCS Inventory was using HTTP headers to determine the service URL used to validate tickets. A remote attacker could possibly use this issue to gain access to a victim's account.
first Jul 24, 2024 -
High max 8.0USN-6913-1 1 CVE
php-cas vulnerability
Filip Hejsek discovered that phpCAS was using HTTP headers to determine the service URL used to validate tickets. A remote attacker could possibly use this issue to gain access to a victim's account on a vulnerable CASified service. This security update intro…
first Jul 24, 2024 -
High max 8.8USN-6912-1 1 CVE
provd vulnerability
James Henstridge discovered that provd incorrectly handled environment variables. A local attacker could possibly use this issue to run arbitrary programs and escalate privileges.
first Jul 24, 2024 -
Medium max 6.2USN-6906-1 1 CVE
python-zipp vulnerability
It was discovered that python-zipp did not properly handle the zip files with malformed names. An attacker could possibly use this issue to cause a denial of service.
first Jul 24, 2024 -
UnscoredUSN-6901-1 1 CVE
stunnel4 vulnerability
It was discovered that stunnel did not properly validate client certificates when configured to use both the redirect and verifyChain options. A remote attacker could potentially use this issue to obtain sensitive information by accessing the tunneled service.
first Jul 18, 2024 -
High max 8.1USN-6889-1 3 CVEs
dotnet6, dotnet8 vulnerabilities
It was discovered that .NET did not properly handle object deserialization. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-30105) Radek Zikmund discovered that .NET did not properly manage memory. An attacker could use this …
first Jul 10, 2024 -
High max 7.5USN-6887-1 1 CVE
openssh vulnerability
Philippos Giavridis, Jacky Wei En Kung, Daniel Hugenroth, and Alastair Beresford discovered that the OpenSSH ObscureKeystrokeTiming feature did not work as expected. A remote attacker could possibly use this issue to determine timing information about keystro…
first Jul 9, 2024 -
Critical max 9.1USN-6860-1 2 CVEs
openvpn vulnerabilities
Reynir Björnsson discovered that OpenVPN incorrectly handled terminating client connections. A remote authenticated client could possibly use this issue to keep the connection active, bypassing certain security policies. This issue only affected Ubuntu 23.10,…
first Jul 2, 2024 -
High max 8.1USN-6859-1 1 CVE
openssh vulnerability
It was discovered that OpenSSH incorrectly handled signal management. A remote attacker could use this issue to bypass authentication and remotely access systems without proper credentials.
first Jul 1, 2024 -
High max 7.5USN-6837-1 4 CVEs
ruby-rack vulnerabilities
It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-27530) It was discover…
first Jun 17, 2024 -
Medium max 6.5USN-6800-1 1 CVE
node-browserify-sign vulnerability
It was discovered that browserify-sign incorrectly handled an upper bound check in signature verification. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a …
first May 30, 2024 -
High max 7.5USN-6794-1 4 CVEs
frr vulnerabilities
It was discovered that FRR incorrectly handled certain malformed BGP and OSPF packets. A remote attacker could use this issue to cause FRR to crash, resulting in a denial of service, or possibly execute arbitrary code.
first May 28, 2024 -
Critical max 9.1USN-6793-2 1 CVE
git vulnerability
USN-6793-1 fixed vulnerabilities in Git. The CVE-2024-32002 was pending further investigation. This update fixes the problem. Original advisory details: It was discovered that Git incorrectly handled certain submodules. An attacker could possibly use this iss…
first Jun 18, 2024 -
Critical max 9.1USN-6793-1 5 CVEs
git vulnerabilities
It was discovered that Git incorrectly handled certain submodules. An attacker could possibly use this issue to execute arbitrary code. This issue was fixed in Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2024-32002) It was discovered that Git in…
first May 28, 2024 -
Medium max 5.4USN-6792-1 1 CVE
flask-security vulnerability
Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs.
first May 28, 2024 -
High max 7.5USN-6785-1 1 CVE
gnome-remote-desktop vulnerability
Matthias Gerstner discovered that GNOME Remote Desktop incorrectly performed certain user validation checks. A local attacker could possibly use this issue to obtain sensitive information, or take control of remote desktop connections.
first May 23, 2024 -
Medium max 6.3USN-6773-1 2 CVEs
dotnet7, dotnet8 vulnerabilities
It was discovered that .NET did not properly handle memory in it's Double Parse routine. An attacker could possibly use this issue to achieve remote code execution. (CVE-2024-30045) It was discovered that .NET did not properly handle the usage of a shared res…
first May 16, 2024 -
High max 7.7USN-6772-1 1 CVE
strongswan vulnerability
Jan Schermer discovered that strongSwan incorrectly validated client certificates in certain configurations. A remote attacker could possibly use this issue to bypass access controls.
first May 14, 2024 -
High max 7.5USN-6771-1 1 CVE
sqlparse vulnerability
It was discovered that SQL parse incorrectly handled certain nested lists. An attacker could possibly use this issue to cause a denial of service.
first May 13, 2024 -
Medium max 6.5USN-6769-1 2 CVEs
libspreadsheet-parsexlsx-perl vulnerabilities
Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. (CVE-2024-22368) An Pham …
first May 9, 2024 -
Medium max 4.9USN-6755-1 1 CVE
cpio vulnerabilities
Ingo Brückl discovered that cpio contained a path traversal vulnerability. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to write arbitrary files outside the target direc…
first Apr 29, 2024 -
High max 7.1USN-6748-1 2 CVEs
ruby-sanitize vulnerabilities
It was discovered that Sanitize incorrectly handled noscript elements under certain circumstances. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-23627) It was dis…
first Apr 24, 2024 -
Medium max 6.7USN-6744-3 1 CVE
pillow vulnerability
USN-6744-1 fixed a vulnerability in Pillow. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which c…
first Apr 29, 2024