8,464 results · Feed
-
High max 8.2USN-5292-2 4 CVEs
snapd vulnerabilities
USN-5292-1 fixed vulnerabilities in snapd. This update provides the corresponding update for the riscv64 architecture. Original advisory details: James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attack…
first Feb 18, 2022 -
High max 8.2USN-5292-1 4 CVEs
snapd vulnerabilities
James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue to expose sensitive information. (CVE-2021-3155) Ian Johnson discovered that snapd did not properly validate cont…
first Feb 17, 2022 -
Medium max 6.5USN-5290-1 2 CVEs
symfony vulnerabilities
James Isaac and Mathias Brodala discovered that Symfony incorrectly handled switch users functionality. An attacker could possibly use this issue to enumerate users. (CVE-2021-21424) It was discovered that Symfony incorrectly handled certain specially crafted…
first Aug 24, 2022 -
Medium max 6.1USN-5276-1 2 CVEs
nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-470, nvidia-graphics-drivers-470-server, nvidia-graphics-drivers-510 vulnerabilities
It was discovered that the NVIDIA graphics drivers incorrectly handled permissions in the kernel mode layer. A local attacker could use this issue to write to protected memory and cause a denial of service.
first Feb 8, 2022 -
High max 7.5USN-5269-1 2 CVEs
python-django vulnerabilities
Keryn Knight discovered that Django incorrectly handled certain template tags. A remote attacker could possibly use this issue to perform a cross-site scripting attack. (CVE-2022-22818) Alan Ryan discovered that Django incorrectly handled file uploads. A remo…
first Feb 3, 2022 -
UnscoredUSN-5249-1 1 CVE
usbview vulnerability
It was discovered that USBView allowed unprivileged users to run usbview as root. A local attacker could use this vulnerability to gain administrative privileges or cause a denial of service.
first Jan 21, 2022 -
High max 7.3USN-5247-1 5 CVEs
vim vulnerabilities
It was discovered that vim incorrectly handled parsing of filenames in its search functionality. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. This issue only affected Ubu…
first Jan 27, 2022 -
UnscoredUSN-5243-1 1 CVE
aide vulnerability
David Bouman discovered that AIDE incorrectly handled base64 operations. A local attacker could use this issue to cause AIDE to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Jan 20, 2022 -
High max 7.7USN-5238-1 1 CVE
libpgjava vulnerability
It was discovered that PostgreSQL JDBC Driver incorrectly handled certain requests from external entities. A remote attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code.
first Sep 6, 2022 -
UnscoredUSN-5219-1 1 CVE
linux, linux-aws, linux-aws-5.11, linux-azure, linux-azure-5.11, linux-gcp, linux-gcp-5.11, linux-hwe-5.11, linux-kvm, linux-oem-5.10, linux-oracle, linux-oracle-5.11, linux-raspi vulnerability
It was discovered that the eBPF implementation in the Linux kernel did not properly validate the memory size of certain ring buffer operation arguments. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary …
first Jan 11, 2022 -
UnscoredUSN-5217-1 2 CVEs
linux-oem-5.14 vulnerabilities
It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4090) It was dis…
first Jan 11, 2022 -
Medium max 5.3USN-5216-1 1 CVE
node-hosted-git-info vulnerability
It was discovered that hosted-git-info incorrectly handled certain inputs. A remote attacker could use this to cause a denial of service.
first Sep 2, 2022 -
Critical max 10.0
apache-log4j2 vulnerability
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. An attacker could use this vulnerability to cause a denial of service. Please see the following link for more information: https:/…
first Dec 15, 2021 -
UnscoredUSN-5195-1 1 CVE
mumble vulnerability
It was discovered that the Mumble client supported websites for public servers with arbitrary URL schemes. If a user were tricked into visiting a malicious website from the public server list, a remote attacker could possibly execute arbitrary code.
first Dec 16, 2021 -
Critical max 10.0
apache-log4j2 vulnerability
Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run programs via a special crafted input. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. Please see the following link for more i…
first Dec 14, 2021 -
UnscoredUSN-5188-1 1 CVE
keepalived vulnerability
It was discovered that Keepalived incorrectly handled certain messages. An attacker could possibly use this issue to access-control bypass.
first Dec 13, 2021 -
High max 8.8USN-5180-1 1 CVE
mailman vulnerability
It was discovered that Mailman incorrectly handled CSRF tokens. A remote list member or moderator could possibly use their own token to craft an admin request CSRF attack and set a new admin password or make other changes.
first Dec 7, 2021 -
High max 7.5USN-5179-1 10 CVEs
busybox vulnerabilities
It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processing a specially crafted gzip archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a d…
first Dec 7, 2021 -
High max 7.3USN-5178-1 1 CVE
python-django vulnerability
Sjoerd Job Postmus and TengMA discovered that Django incorrectly handled URLs with trailing newlines. A remote attacker could possibly use this issue to bypass certain access controls.
first Dec 7, 2021 -
Medium max 4.4USN-5175-1 1 CVE
ntp vulnerability
It was discovered that ntpd incorrectly handled memory when CMAC keys were used. A remote attacker could possibly use this issue to cause ntpd to crash resulting in a denial of service.
first Dec 6, 2021 -
UnscoredUSN-5171-1 10 CVEs
lrzip vulnerabilities
It was discovered that Long Range ZIP incorrectly handled certain specially crafted lrz files. A remote attacker could possibly use this issue to cause a denial of service (crash) or other unspecified impact.
first Dec 6, 2021 -
Medium max 5.4USN-5157-1 1 CVE
postorius vulnerability
It was discovered that Postorius mishandled specially crafted input. An attacker could use this vulnerability that obtain sensitive information.
first Nov 25, 2021 -
UnscoredUSN-5151-2 2 CVEs
mailman vulnerabilities
USN-5151-1 fixed several vulnerabilities in Mailman. This update provides the corresponding update for Ubuntu 20.04 ESM. Original advisory details: It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue to ex…
first Nov 25, 2021 -
UnscoredUSN-5122-1 0 CVEs
apport vulnerability
It was discovered that Apport could be tricked into writing core files as root into arbitrary directories in certain scenarios. A local attacker could possibly use this issue to escalate privileges. This update will cause Apport to generate all core files in …
first Oct 25, 2021 -
UnscoredUSN-5121-2 5 CVEs
mailman vulnerabilities
USN-5009-1 fixed vulnerabilities in Mailman. This update provides the corresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs were fixed: It was discovered that Mailman allows arbitrary content injection. An attacker could use this to inje…
first Nov 1, 2021 -
Critical max 9.1USN-5102-1 2 CVEs
mercurial vulnerabilities
It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this issue to write arbitrary files to the target’s filesystem. (CVE-2019-3902) It was discovered that Mercurial incorrectly handled certain manifest files. An atta…
first Oct 4, 2021 -
High max 7.5USN-5101-1 1 CVE
mongodb vulnerability
It was discovered that MongoDB incorrectly handled certain wire protocol messages. A remote attacker could possibly use this issue to cause MongoDB to crash, resulting in a denial of service.
first Oct 4, 2021 -
Medium max 5.9USN-5100-1 1 CVE
containerd vulnerability
It was discovered that containerd insufficiently restricted permissions on container root and plugin directories. If a user or automated system were tricked into launching a specially crafted container image, a remote attacker could traverse directory content…
first Oct 4, 2021 -
High max 8.8USN-5097-1 3 CVEs
ledgersmb vulnerabilities
It was discovered that LedgerSMB incorrectly handled certain inputs. An attacker could use this to leak sensitive information, cause a DoS, or execute arbitrary code. (CVE-2021-3693, CVE-2021-3694, CVE-2021-3731)
first Sep 30, 2021 -
UnscoredUSN-5092-3 0 CVEs
linux-azure, linux-azure-5.11 regression
USN-5092-2 fixed vulnerabilities in Linux 5.11-based kernels. Unfortunately, for Linux kernels intended for use within Microsoft Azure environments, that update introduced a regression that could cause the kernel to fail to boot in large Azure instance types.…
first Oct 18, 2021 -
UnscoredUSN-5091-3 0 CVEs
linux-azure, linux-azure-5.4 regression
USN-5091-1 fixed vulnerabilities in Linux 5.4-based kernels. Unfortunately, for Linux kernels intended for use within Microsoft Azure environments, that update introduced a regression that could cause the kernel to fail to boot in large Azure instance types. …
first Oct 15, 2021 -
UnscoredUSN-5089-1 0 CVEs
ca-certificates update
The ca-certificates package contained a CA certificate that will expire on 2021-09-30 and will cause connectivity issues. This update removes the “DST Root CA X3” CA.
first Sep 23, 2021 -
UnscoredUSN-5078-3 1 CVE
squashfs-tools vulnerability
USN-5078-1 fixed a vulnerability in Squashfs-Tools. That update was incomplete and could still result in Squashfs-Tools mishandling certain malformed SQUASHFS files. This update fixes the problem. We apologize for the inconvenience. Original advisory details:…
first Oct 13, 2021 -
UnscoredUSN-5078-1 1 CVE
squashfs-tools vulnerability
Richard Weinberger discovered that Squashfs-Tools mishandled certain malformed SQUASHFS files. An attacker could use this vulnerability to write arbitrary files to the filesystem.
first Sep 15, 2021 -
Medium max 6.5USN-5077-1 2 CVEs
apport vulnerabilities
Maik Münch and Stephen Röttger discovered that Apport incorrectly handled certain information gathering operations. A local attacker could use this issue to gain read access to arbitrary files, possibly containing sensitive information.
first Sep 14, 2021 -
Medium max 6.5USN-5066-1 1 CVE
python-pysaml2 vulnerability
Brian Wolff discovered that PySAML2 incorrectly validated cryptographic signatures. A remote attacker could possibly use this issue to alter SAML documents.
first Sep 8, 2021 -
Medium max 5.5USN-5065-1 1 CVE
openvswitch vulnerability
It was discovered that Open vSwitch incorrectly handled decoding RAW_ENCAP actions. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Sep 8, 2021 -
High max 7.8USN-5064-1 1 CVE
cpio vulnerability
Maverick Chung and Qiaoyi Fang discovered that cpio incorrectly handled certain pattern files. A remote attacker could use this issue to cause cpio to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Sep 8, 2021 -
UnscoredUSN-5063-1 1 CVE
haproxy vulnerabilities
Ori Hollander discovered that HAProxy incorrectly handled HTTP header name length encoding. A remote attacker could possibly use this issue to inject a duplicate content-length header and perform request smuggling attacks.
first Sep 8, 2021 -
UnscoredUSN-5057-1 1 CVE
squashfs-tools vulnerability
Etienne Stalmans discovered that Squashfs-Tools mishandled certain malformed SQUASHFS files. An attacker could use this vulnerability to write arbitrary files to the filesystem.
first Aug 31, 2021