8,464 results · Feed
-
High max 7.7USN-6018-1 1 CVE
apport vulnerability
Chen Lu, Lei Wang, and YiQi Sun discovered a privilege escalation vulnerability in apport-cli when viewing crash reports and unprivileged users are allowed to run sudo less. A local attacker on a specially configured system could use this to escalate their pr…
first Apr 13, 2023 -
High max 8.6USN-6016-1 1 CVE
node-thenify vulnerability
It was discovered that thenify incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code.
first Apr 13, 2023 -
High max 7.5USN-6011-1 2 CVEs
json-smart vulnerabilities
It was discovered that Json-smart incorrectly handled memory when processing input containing unclosed quotes. A remote attacker could possibly use this issue to cause applications using Json-smart to crash, leading to a denial of service. (CVE-2021-31684) It…
first Apr 12, 2023 -
High max 7.8USN-6006-1 1 CVE
dotnet6, dotnet7 vulnerability
It was discovered that .NET did not properly manage dll files. An attacker could potentially use this issue to execute arbitrary code.
first Apr 11, 2023 -
High max 7.5USN-5994-1 1 CVE
haproxy vulnerability
It was discovered that HAProxy incorrectly initialized certain connection buffers. A remote attacker could possibly use this issue to obtain sensitive information.
first Apr 3, 2023 -
Medium max 6.7USN-5966-3 3 CVEs
amanda regression
USN-5966-1 fixed vulnerabilities in amanda. Unfortunately that update caused a regression and was reverted in USN-5966-2. This update provides security fixes for Ubuntu 22.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. We apologize for the incon…
first Apr 3, 2023 -
Medium max 6.7USN-5966-1 3 CVEs
amanda vulnerabilities
Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information. (CVE-2022-377…
first Mar 23, 2023 -
High max 8.8USN-5949-1 22 CVEs
chromium-browser vulnerabilities
It was discovered that Chromium could be made to write out of bounds in several components. A remote attacker could possibly use this issue to corrupt memory via a crafted HTML page, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2…
first Mar 13, 2023 -
UnscoredUSN-5921-1 1 CVE
rsync vulnerabilities
Koen van Hove discovered that the rsync client incorrectly validated filenames returned by servers. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could use this issue to write arbitrary files, and possibly…
first Mar 6, 2023 -
High max 7.2USN-5908-1 1 CVE
sudo vulnerability
It was discovered that Sudo incorrectly handled the per-command chroot feature. In certain environments where Sudo is configured with a rule that contains a CHROOT setting, a local attacker could use this issue to cause Sudo to crash, resulting in a denial of…
first Mar 2, 2023 -
Critical max 10.0USN-5896-1 2 CVEs
ruby-rack vulnerabilities
It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a user or automated system were tricked into sending a specially crafted multipart POST request to an application using Rack, a remote attacker could possibl…
first Feb 27, 2023 -
High max 8.8USN-5881-1 13 CVEs
chromium-browser vulnerabilities
It was discovered that Chromium did not properly manage memory. A remote attacker could possibly use these issues to cause a denial of service or execute arbitrary code via a crafted HTML page. (CVE-2023-0471, CVE-2023-0472, CVE-2023-0473, CVE-2023-0696, CVE-…
first Feb 21, 2023 -
Medium max 5.5USN-5871-2 1 CVE
git regression
USN-5871-1 fixed vulnerabilities in Git. A backport fixing part of the vulnerability in CVE-2023-22490 was required. This update fix this for Ubuntu 18.04 LTS. Original advisory details: It was discovered that Git incorrectly handled certain repositories. An …
first Mar 2, 2023 -
Critical max 9.1USN-5869-1 1 CVE
haproxy vulnerability
Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg, and Harvey Tuch discovered that HAProxy incorrectly handled empty header names. A remote attacker could possibly use this issue to manipulate headers and bypass certain authentication c…
first Feb 14, 2023 -
UnscoredUSN-5857-1 1 CVE
linux-oem-6.0 vulnerability
Davide Ornaghi discovered that the netfilter subsystem in the Linux kernel did not properly handle VLAN headers in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
first Feb 9, 2023 -
High max 7.5USN-5848-1 1 CVE
less vulnerability
David Leadbeater discovered that less was not properly handling escape sequences when displaying raw control characters. A maliciously formed OSC 8 hyperlink could possibly be used by an attacker to cause a denial of service.
first Feb 9, 2023 -
Medium max 6.5USN-5819-1 1 CVE
haproxy vulnerability
It was discovered that HAProxy incorrectly handled certain messages. A remote attacker could possibly use this issue to cause HAProxy to stop responding, resulting in a denial of service.
first Jan 23, 2023 -
High max 7.5USN-5812-1 1 CVE
python-urllib3 vulnerability
It was discovered that urllib3 incorrectly handled certain characters in URLs. A remote attacker could possibly use this issue to cause urllib3 to consume resources, leading to a denial of service.
first Jan 19, 2023 -
UnscoredUSN-5810-2 0 CVEs
git regression
USN-5810-1 fixed vulnerabilities in Git. This update introduced a regression as it was missing some commit lines. This update fixes the problem. Original advisory details: Markus Vervier and Eric Sesterhenn discovered that Git incorrectly handled certain gita…
first Jan 19, 2023 -
Critical max 9.8USN-5810-1 2 CVEs
git vulnerabilities
Markus Vervier and Eric Sesterhenn discovered that Git incorrectly handled certain gitattributes. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-23521) Joern Schneeweisz discovered that Git incorrectly handled …
first Jan 17, 2023 -
High max 8.4USN-5801-1 2 CVEs
vim vulnerabilities
It was discovered that Vim makes illegal memory calls when pasting brackets in Ex mode. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands. This issue affected only Ubuntu 20.04 and 22.04 (CVE-2022-0392) I…
first Jan 12, 2023 -
High max 7.8USN-5799-1 1 CVE
linux-oem-5.17, linux-oem-6.0 vulnerability
Kyle Zeng discovered that the sysctl implementation in the Linux kernel contained a stack-based buffer overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.
first Jan 11, 2023 -
High max 7.5USN-5798-1 1 CVE
dotnet6 vulnerability
Johan Gorter discovered that .NET 6 incorrectly processed certain invalid HTTP requests. An attacker could possibly use this issue to cause a denial of service condition for an exposed endpoint.
first Jan 10, 2023 -
Critical max 9.1USN-5777-2 2 CVEs
pillow-python2 vulnerabilities
USN-5777-1 fixed vulnerabilities in Pillow (Python 3). This update provides the corresponding updates for Pillow (Python 2) in Ubuntu 20.04 LTS. Original advisory details: It was discovered that Pillow incorrectly handled the deletion of temporary files when …
first Dec 14, 2022 -
Critical max 9.1USN-5777-1 2 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled the deletion of temporary files when using a temporary directory that contains spaces. An attacker could possibly use this issue to delete arbitrary files. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-…
first Dec 13, 2022 -
High max 7.5USN-5763-1 4 CVEs
numpy vulnerabilities
It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-202…
first Dec 7, 2022 -
UnscoredUSN-5761-1 0 CVEs
ca-certificates update
Due to security concerns, the TrustCor certificate authority has been marked as distrusted in Mozilla's root store. This update removes the TrustCor CA certificates from the ca-certificates package.
first Dec 5, 2022 -
High max 7.0USN-5748-1 1 CVE
sysstat vulnerability
It was discovered that Sysstat incorrectly handled certain arithmetic multiplications. An attacker could use this issue to cause Sysstat to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 29, 2022 -
UnscoredUSN-5731-1 2 CVEs
multipath-tools vulnerabilities
It was discovered that multipath-tools incorrectly handled symlinks. A local attacker could possibly use this issue, in combination with other issues, to escalate privileges. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-…
first Nov 17, 2022 -
Medium max 6.1USN-5698-1 1 CVE
openvswitch vulnerability
It was discovered that Open vSwitch incorrectly handled comparison of certain minimasks. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Oct 25, 2022 -
High max 8.5USN-5686-1 2 CVEs
git vulnerabilities
Cory Snider discovered that Git incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause an unexpected behaviour. (CVE-2022-39253) Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attack…
first Oct 18, 2022 -
High max 7.8USN-5670-1 1 CVE
dotnet6 vulnerability
Edward Thomson discovered that .NET 6 incorrectly handled permissions for local NuGet cache. A local attacker could possibly use this issue to execute arbitrary code.
first Oct 11, 2022 -
High max 7.8USN-5659-1 2 CVEs
kitty vulnerabilities
Stephane Chauveau discovered that kitty incorrectly handled image filenames with special characters in error messages. A remote attacker could possibly use this to execute arbitrary commands. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-35605) Carter …
first Oct 5, 2022 -
High max 7.5USN-5653-1 1 CVE
python-django vulnerability
Benjamin Balder Bach discovered that Django incorrectly handled certain internationalized URLs. A remote attacker could possibly use this issue to cause Django to crash, resulting in a denial of service.
first Oct 4, 2022 -
High max 8.6USN-5641-1 2 CVEs
squid, squid3 vulnerabilities
Mikhail Evdokimov discovered that Squid incorrectly handled cache manager ACLs. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-41317) It was discovere…
first Sep 26, 2022 -
Medium max 5.7USN-5632-1 1 CVE
python-oauthlib vulnerability
Sebastian Chnelik discovered that OAuthLib incorrectly handled certain redirect uris. A remote attacker could possibly use this issue to cause OAuthLib to crash, resulting in a denial of service.
first Sep 22, 2022 -
High max 8.4USN-5613-2 7 CVEs
vim regression
USN-5613-1 fixed vulnerabilities in Vim. Unfortunately that update failed to include binary packages for some architectures. This update fixes that regression. We apologize for the inconvenience. Original advisory details: It was discovered that Vim was not p…
first Sep 19, 2022 -
Medium max 5.5USN-5612-1 1 CVE
intel-microcode vulnerability
Pietro Borrello, Andreas Kogler, Martin Schwarzl, Daniel Gruss, Michael Schwarz and Moritz Lipp discovered that some Intel processors did not properly clear data between subsequent xAPIC MMIO reads. This could allow a local attacker to compromise SGX enclaves.
first Sep 15, 2022 -
High max 7.5USN-5610-1 1 CVE
rust-regex vulnerability
Addison Crump discovered that rust-regex did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could possibly use this issue to cause a denial of service.
first Sep 14, 2022 -
High max 7.5USN-5609-1 1 CVE
dotnet6 vulnerability
Graham Esau discovered that .NET 6 incorrectly parsed certain payloads during model binding. An attacker could possibly use this issue to cause a denial of service.
first Sep 13, 2022