8,464 results · Feed
-
UnscoredUSN-6263-2 0 CVEs
openjdk-lts, openjdk-17 regression
USN-6263-1 fixed vulnerabilities in OpenJDK. Unfortunately, that update introduced a regression when opening APK, ZIP or JAR files in OpenJDK 11 and OpenJDK 17. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Moto…
first Aug 30, 2023 -
UnscoredUSN-6245-1 0 CVEs
openstack-trove vulnerabilities
Adam Bell discovered that Trove incorrectly handled arguments to the backup command. A remote attacker could possibly use this issue to execute arbitrary code.
first Jul 25, 2023 -
UnscoredUSN-6243-2 0 CVEs
graphite-web regression
USN-6243-1 fixed vulnerabilities in Graphite-Web. It was discovered that the applied fix was incomplete. This update fixes the problem. Original advisory details: It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automate…
first Aug 9, 2023 -
Medium max 6.5USN-6241-1 1 CVE
cinder, ironic, nova, python-glance-store, python-os-brick vulnerability
Jan Wasilewski and Gorka Eguileor discovered that OpenStack incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes,…
first Jul 24, 2023 -
Critical max 9.8USN-6226-1 2 CVEs
scipy vulnerabilities
It was discovered that SciPy did not properly manage memory operations during reference counting. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-25399) A use-after-free was discovered in SciPy when handling reference counts.…
first Jul 13, 2023 -
High max 8.1USN-6217-1 1 CVE
dotnet6, dotnet7 vulnerability
McKee-Harris, Matt Cotterell, and Jack Moran discovered that .NET did not properly update account lockout maximum failed attempts. An attacker could possibly use this issue to bypass the security feature and attempt to guess more passwords for an account.
first Jul 11, 2023 -
High max 7.8USN-6196-1 1 CVE
python-reportlab vulnerability
It was discovered that ReportLab incorrectly handled certain PDF files. An attacker could possibly use this issue to execute arbitrary code.
first Jul 3, 2023 -
High max 8.4USN-6195-1 6 CVEs
vim vulnerabilities
It was discovered that Vim contained an out-of-bounds read vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0128) It was discovered that Vim did not properly manage memory when freeing …
first Jul 3, 2023 -
UnscoredUSN-6170-1 0 CVEs
libpod vulnerabilities
It was discovered that Podman incorrectly handled certain images. An attacker could possibly use this issue to pull an untrusted image.
first Jun 16, 2023 -
UnscoredUSN-6161-2 0 CVEs
dotnet6, dotnet7 regression
USN-6161-1 fixed vulnerabilities in .NET. The update introduced a regression with regards to how the runtime imported X.509 certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that .NET…
first Jun 23, 2023 -
High max 7.5USN-6161-1 5 CVEs
dotnet6, dotnet7 vulnerabilities
It was discovered that .NET did not properly enforce certain restrictions when deserializing a DataSet or DataTable from XML. An attacker could possibly use this issue to elevate their privileges. (CVE-2023-24936) Kevin Jones discovered that .NET did not prop…
first Jun 13, 2023 -
Medium max 6.1USN-6155-1 1 CVE
requests vulnerability
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly leaked Proxy-Authorization headers. A remote attacker could possibly use this issue to obtain sensitive information.
first Jun 12, 2023 -
UnscoredUSN-6152-1 0 CVEs
linux-gke regression
It was discovered that NFS client's access cache implementation in the Linux kernel caused a severe NFS performance degradation in certain conditions. This updated makes the NFS file-access stale cache behavior to be optional.
first Jun 8, 2023 -
Critical max 9.8USN-6148-1 1 CVE
sniproxy vulnerability
It was discovered that SNI Proxy did not properly handle wildcard backend hosts. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service, or arbitrary code execution.
first Jun 12, 2023 -
Critical max 9.8USN-6141-1 1 CVE
xfce4-settings vulnerability
Robin Peraglie and Johannes Moritz discovered that xfce4-settings incorrectly parsed quoted input when processed through xdg-open. A remote attacker could possibly use this issue to inject arbitrary arguments into the default browser or file manager.
first Jun 6, 2023 -
UnscoredUSN-6136-1 1 CVE
frr vulnerabilities
It was discovered that FRR incorrectly handled parsing certain BGP messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected Ubuntu 23.04. (CVE-2023-31489) It was discovered tha…
first Jun 5, 2023 -
High max 7.4USN-6116-1 1 CVE
node-hawk vulnerability
It was discovered that hawk incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.
first May 30, 2023 -
High max 7.5USN-6114-1 1 CVE
node-nth-check vulnerability
Yeting Li discovered that nth-check incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.
first May 30, 2023 -
High max 7.5USN-6111-1 1 CVE
flask vulnerability
It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive information.
first May 29, 2023 -
UnscoredUSN-6106-1 0 CVEs
calamares-settings-ubuntu vulnerability
It was discovered that calamares-settings-ubuntu allowed creating the first user with a blank password, contrary to expectations.
first May 24, 2023 -
UnscoredUSN-6105-1 0 CVEs
ca-certificates update
The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.60 version of the Mozilla certificate authority bundle.
first May 24, 2023 -
Critical max 9.8USN-6103-1 1 CVE
node-json-schema vulnerability
It was discovered that JSON Schema incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to exploit JavaScript runtimes and cause a denial…
first May 24, 2023 -
High max 7.0USN-6088-1 3 CVEs
runc vulnerabilities
It was discovered that runC incorrectly made /sys/fs/cgroup writable when in rootless mode. An attacker could possibly use this issue to escalate privileges. (CVE-2023-25809) It was discovered that runC incorrectly performed access control when mounting /proc…
first May 18, 2023 -
High max 7.5USN-6086-1 1 CVE
node-minimatch vulnerability
It was discovered that minimatch incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.
first May 18, 2023 -
High max 8.8USN-6076-1 7 CVEs
matrix-synapse vulnerabilities
It was discovered that Synapse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2019-18835, CVE-20…
first May 16, 2023 -
UnscoredUSN-6073-9 0 CVEs
python-os-brick regression
USN-6073-4 fixed a vulnerability in os-brick. Unfortunately the update introduced a regression with detaching volumes. The security fix has been removed pending further investigation. We apologize for the inconvenience. Original advisory details: Jan Wasilews…
first May 23, 2023 -
UnscoredUSN-6073-8 0 CVEs
nova regression
USN-6073-3 fixed a vulnerability in Nova. Unfortunately the update introduced a regression with detaching volumes. The security fix has been removed pending further investigation. We apologize for the inconvenience. Original advisory details: Jan Wasilewski a…
first May 23, 2023 -
UnscoredUSN-6073-7 0 CVEs
python-glance-store regression
USN-6073-2 fixed a vulnerability in Glance_store. Unfortunately the update introduced a regression with detaching volumes. The security fix has been removed pending further investigation. We apologize for the inconvenience. Original advisory details: Jan Wasi…
first May 23, 2023 -
UnscoredUSN-6073-6 0 CVEs
cinder regression
USN-6073-1 fixed a vulnerability in Cinder. Unfortunately the update introduced a regression with detaching volumes. The security fix has been removed pending further investigation. We apologize for the inconvenience. Original advisory details: Jan Wasilewski…
first May 23, 2023 -
UnscoredUSN-6073-5 0 CVEs
nova regression
USN-6073-3 fixed a vulnerability in Nova. The update introduced a regression causing Nova to be unable to detach volumes from instances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jan Wasilewski and Gorka Egu…
first May 14, 2023 -
Medium max 6.5USN-6073-4 1 CVE
python-os-brick vulnerability
Jan Wasilewski and Gorka Eguileor discovered that os-brick incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes t…
first May 11, 2023 -
Medium max 6.5USN-6073-3 1 CVE
nova vulnerability
Jan Wasilewski and Gorka Eguileor discovered that Nova incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes to be…
first May 11, 2023 -
Medium max 6.5USN-6073-2 1 CVE
python-glance-store vulnerability
Jan Wasilewski and Gorka Eguileor discovered that Glance_store incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration chang…
first May 11, 2023 -
Medium max 6.5USN-6073-1 1 CVE
cinder vulnerability
Jan Wasilewski and Gorka Eguileor discovered that Cinder incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes to …
first May 11, 2023 -
Medium max 5.5USN-6064-1 1 CVE
sqlparse vulnerability
It was discovered that SQL parse incorrectly handled certain regular expression. An attacker could possibly use this issue to cause a denial of service.
first May 10, 2023 -
Critical max 9.8USN-6054-1 1 CVE
python-django vulnerability
Moataz Al-Sharida and nawaik discovered that Django incorrectly handled uploading multiple files using one form field. A remote attacker could possibly use this issue to bypass certain validations.
first May 3, 2023 -
High max 7.5USN-6050-1 3 CVEs
git vulnerabilities
It was discovered that Git incorrectly handled certain commands. An attacker could possibly use this issue to overwriting some paths. (CVE-2023-25652) Maxime Escourbiac and Yassine BENGANA discovered that Git incorrectly handled some gettext machinery. An att…
first May 1, 2023 -
UnscoredUSN-6042-2 0 CVEs
cloud-init regression
USN-6042-1 fixed a vulnerability in Cloud-init. The update introduced a regression on Ubuntu 20.04 LTS resulting in a possible loss of networking. This update fixes the problem. We apologize for the inconvenience. Original advisory details: James Golovich dis…
first May 23, 2023 -
Critical max 9.8USN-6021-1 20 CVEs
chromium-browser vulnerabilities
It was discovered that Chromium did not properly manage memory in several components. A remote attacker could possibly use this issue to corrupt memory via a crafted HTML page, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-15…
first Apr 28, 2023 -
High max 7.5USN-6019-1 1 CVE
python-flask-cors vulnerability
It was discovered that Flask-CORS did not properly escape paths before evaluating resource rules. An attacker could possibly use this to expose sensitive information.
first Apr 13, 2023