8,464 results · Feed
-
UnscoredUSN-5552-1 1 CVE
phpliteadmin vulnerability
It was discovered that phpLiteAdmin incorrectly handled certain GET requests. An attacker could possibly use this issue to perform cross-site scripting (XSS) attacks.
first Aug 8, 2022 -
High max 7.5USN-5551-1 1 CVE
mod-wsgi vulnerability
It was discovered that mod-wsgi did not correctly remove the X-Client-IP header when processing requests from untrusted proxies. A remote attacker could use this issue to pass the header to WSGI applications, contrary to expectations.
first Aug 4, 2022 -
High max 8.8USN-5549-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain FileResponse. An attacker could possibly use this issue to expose sensitive information or gain access over user machine.
first Aug 4, 2022 -
Critical max 9.8USN-5532-1 1 CVE
python-bottle vulnerability
It was discovered that Bottle incorrectly handled errors during early request binding. An attacker could possibly use this issue to disclose sensitive information. (CVE-2022-31799)
first Jul 26, 2022 -
UnscoredUSN-5527-1 5 CVEs
check-mk vulnerabilities
It was discovered that Checkmk incorrectly handled authentication. An attacker could possibly use this issue to cause a race condition leading to information disclosure. (CVE-2017-14955) It was discovered that Checkmk incorrectly handled certain inputs. An at…
first Jul 20, 2022 -
UnscoredUSN-5526-2 0 CVEs
pyjwt regression
USN-5526-1 fixed vulnerabilities in PyJWT. Unfortunately this caused a regression by incrementing the internal package version number on Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Aapo Oksma…
first Aug 17, 2022 -
High max 7.4USN-5526-1 1 CVE
pyjwt vulnerability
Aapo Oksman discovered that PyJWT incorrectly handled signatures constructed from SSH public keys. A remote attacker could use this to forge a JWT signature.
first Jul 20, 2022 -
High max 7.3USN-5520-1 1 CVE
libhttp-daemon-perl vulnerability
It was discovered that HTTP-Daemon incorrectly handled certain crafted requests. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack.
first Jul 14, 2022 -
High max 7.8USN-5511-1 1 CVE
git vulnerabilities
Carlo Marcelo Arenas Belón discovered that an issue related to CVE-2022-24765 still affected Git. An attacker could possibly use this issue to run arbitrary commands as administrator. (CVE-2022-29187)
first Jul 13, 2022 -
Medium max 6.5USN-5508-1 1 CVE
python-ldap vulnerability
It was discovered that Python LDAP incorrectly handled certain regular expressions. An remote attacker could possibly use this issue to cause a denial of service.
first Jul 11, 2022 -
UnscoredUSN-5503-1 1 CVE
gnupg2 vulnerability
Demi Marie Obenour discovered that GnuPG incorrectly handled injection in the status message. A remote attacker could possibly use this issue to forge signatures.
first Jul 5, 2022 -
Critical max 9.8USN-5501-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain SQL. An attacker could possibly use this issue to expose sensitive information.
first Jul 4, 2022 -
Medium max 5.5USN-5496-1 1 CVE
cloud-init vulnerability
Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An attacker with access to these logs could potentially use this to gain user credentials.
first Jun 29, 2022 -
UnscoredUSN-5473-1 0 CVEs
ca-certificates update
The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.50 version of the Mozilla certificate authority bundle.
first Jun 8, 2022 -
Medium max 4.4USN-5459-1 4 CVEs
cifs-utils vulnerabilities
Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-143…
first Jun 2, 2022 -
Medium max 6.5USN-5447-1 1 CVE
logrotate vulnerability
It was discovered that logrotate incorrectly handled the state file. A local attacker could possibly use this issue to keep a lock on the state file and cause logrotate to stop working, leading to a denial of service.
first May 26, 2022 -
UnscoredUSN-5438-1 1 CVE
htmldoc vulnerability
It was discovered that HTMLDOC did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted HTML file, a remote attacker could possibly use this issue to cause HTMLDOC to crash, resulting in a denial of s…
first May 23, 2022 -
UnscoredUSN-5395-2 0 CVEs
networkd-dispatcher regression
USN-5395-1 fixed vulnerabilities in networkd-dispatcher. Unfortunately that update was incomplete and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that networkd-d…
first May 4, 2022 -
Medium max 5.5USN-5395-1 2 CVEs
networkd-dispatcher vulnerabilities
It was discovered that networkd-dispatcher incorrectly handled internal scripts. A local attacker could possibly use this issue to cause a race condition, escalate privileges and execute arbitrary code. (CVE-2022-29799, CVE-2022-29800)
first Apr 28, 2022 -
Low max 3.1USN-5386-1 1 CVE
python-aiohttp vulnerability
Jelmer Vernooij and Beast Glatisant discovered that AIOHTTP incorrectly handled certain URLs, leading to an open redirect attack. A remote attacker could possibly use this issue to perform phishing attacks.
first Apr 21, 2022 -
High max 8.8USN-5378-1 1 CVE
gzip vulnerability
Cleemy Desu Wayo discovered that Gzip incorrectly handled certain filenames. If a user or automated system were tricked into performing zgrep operations with specially crafted filenames, a remote attacker could overwrite arbitrary files.
first Apr 13, 2022 -
UnscoredUSN-5376-3 0 CVEs
git regression
USN-5376-1 fixed vulnerabilities in Git, some patches were missing to properly fix the issue. This update fixes the problem. Original advisory details: 俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users suppo…
first Apr 26, 2022 -
Medium max 6.0USN-5376-2 1 CVE
git vulnerability
USN-5376-1 fixed vulnerabilities in Git. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: 俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users support. An attacker…
first Apr 25, 2022 -
Medium max 6.0USN-5376-1 1 CVE
git vulnerability
俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users support. An attacker could possibly use this issue to run arbitrary commands.
first Apr 12, 2022 -
Critical max 9.8USN-5373-1 3 CVEs
python-django vulnerabilities
It was discovered that Django incorrectly handled certain certain column aliases in the QuerySet.annotate(), aggregate(), and extra() methods. A remote attacker could possibly use this issue to perform an SQL injection attack. (CVE-2022-28346) It was discover…
first Apr 11, 2022 -
Critical max 9.8USN-5365-1 2 CVEs
h2database vulnerabilities
It was discovered that H2 was vulnerable to deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-42392) It was discovered that H2 incorrectly handled some specially crafted connection URLs. An attac…
first Apr 5, 2022 -
High max 7.5USN-5364-1 1 CVE
waitress vulnerability
It was discovered that Waitress incorrectly handled certain requests. An attacker could possibly use this issue to expose sensitive information.
first Apr 5, 2022 -
High max 7.5USN-5359-1 1 CVE
rsync vulnerability
Danilo Ramos discovered that rsync incorrectly handled memory when performing certain zlib deflating operations. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 31, 2022 -
UnscoredUSN-5356-1 2 CVEs
dosbox vulnerabilities
Alexandre Bartel discovered that DOSBox incorrectly handled long lines in certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-7165) Alexandre Bartel discovered that DOSBox incorrectly performed access control over cer…
first Mar 30, 2022 -
High max 8.8
chromium-browser vulnerability
It was discovered that Chromium incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.
first Mar 28, 2022 -
Critical max 9.8USN-5348-3 4 CVEs
smarty3 vulnerabilities
USN-5348-1 fixed several vulnerabilities in Smarty. This update provides the fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and CVE-2021-29454 for Ubuntu 20.04 ESM. Original advisory details: David Gnedt and Thomas Konrad discovered that Smarty was …
first Jun 21, 2022 -
Critical max 9.8USN-5348-1 6 CVEs
smarty3 vulnerabilities
David Gnedt and Thomas Konrad discovered that Smarty was incorrectly sanitizing the paths present in the templates. An attacker could possibly use this use to read arbitrary files when controlling the executed template. (CVE-2018-13982) It was discovered that…
first Mar 28, 2022 -
Critical max 9.8USN-5347-1 1 CVE
openvpn vulnerability
It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use this issue to bypass authentication using incomplete credentials.
first Mar 24, 2022 -
Critical max 9.1USN-5346-1 1 CVE
linux-oem-5.14 vulnerability
It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in certain situations. A remote attacker could possibly use this to cause a denial of service (memory exhaustion).
first Mar 24, 2022 -
Critical max 10.0
redis vulnerability
Reginaldo Silva discovered that due to a packaging issue, a remote attacker with the ability to execute arbitrary Lua scripts could possibly escape the Lua sandbox and execute arbitrary code on the host.
first Mar 8, 2022 -
UnscoredUSN-5313-2 0 CVEs
openjdk-lts regression
USN-5313-1 fixed vulnerabilities and added features in OpenJDK. Unfortunately, that update introduced a regression in OpenJDK 11 that could impact interoperability with some popular HTTP/2 servers making it unable to connect to said servers. This update fixes…
first Mar 29, 2022 -
UnscoredUSN-5312-1 1 CVE
haproxy vulnerability
It was discovered that HAProxy incorrectly handled certain headers. A remote attacker could possibly use this issue to cause HAProxy to stop responding, resulting in a denial of service.
first Mar 3, 2022 -
High max 7.5USN-5311-2 1 CVE
containerd regression
USN-5311-1 released updates for contained. Unfortunately, a subsequent update reverted the fix for this CVE by mistake. This update corrects the problem. We apologize for the inconvenience. Original advisory details: It was discovered that containerd allows a…
first May 16, 2022 -
High max 7.5USN-5311-1 1 CVE
containerd vulnerability
It was discovered that containerd allows attackers to gain access to read- only copies of arbitrary files and directories on the host via a specially- crafted image configuration. An attacker could possibly use this issue to obtain sensitive information.
first Mar 3, 2022 -
High max 7.5USN-5293-1 1 CVE
c3p0 vulnerability
Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the application's XML configuration file could cause a denial of service.
first Feb 21, 2022