8,464 results · Feed
-
UnscoredUSN-5042-1 0 CVEs
haproxy vulnerabilities
It was discovered that HAProxy incorrectly handled the HTTP/2 protocol. A remote attacker could possibly use this issue to bypass restrictions.
first Aug 17, 2021 -
UnscoredUSN-5032-1 0 CVEs
docker.io vulnerabilities
Several vulnerabilities were fixed in Docker. This update provides a new upstream version that fixed them.
first Aug 5, 2021 -
Medium max 5.0USN-5012-1 1 CVE
containerd vulnerabilities
It was discovered that containerd incorrectly handled file permission changes. If a user or automated system were tricked into launching a specially crafted container image, a remote attacker could change permissions on files on the host filesystem and possib…
first Jul 20, 2021 -
Medium max 6.8
libimage-exiftool-perl vulnerability
It was discovered that ExifTool did not properly sanitize user data for the DjVu file format. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code.
first Jun 10, 2021 -
UnscoredUSN-4986-3 0 CVEs
rpcbind regression
USN-4986-1 fixed a vulnerability in rpcbind. The update caused a regression resulting in rpcbind crashing in certain environments. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that rpcbind inc…
first Jun 10, 2021 -
Medium max 4.0USN-4976-1 1 CVE
dnsmasq vulnerability
Petr Mensik discovered that Dnsmasq incorrectly randomized source ports in certain configurations. A remote attacker could possibly use this issue to facilitate DNS cache poisoning attacks.
first Jun 2, 2021 -
High max 7.5USN-4975-1 3 CVEs
python-django vulnerabilities
It was discovered that the Django URLValidator function incorrectly handled newlines and tabs. A remote attacker could possibly use this issue to perform a header injection attack. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CV…
first Jun 2, 2021 -
UnscoredUSN-4967-1 1 CVE
nginx vulnerability
Luis Merino, Markus Vervier, and Eric Sesterhenn discovered that nginx incorrectly handled responses to the DNS resolver. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code.
first May 26, 2021 -
High max 7.3USN-4965-1 11 CVEs
apport vulnerabilities
Maik Münch discovered that Apport incorrectly handled certain information gathering operations. A local attacker could use these issues to read and write arbitrary files as an administrator, and possibly escalate privileges.
first May 25, 2021 -
UnscoredUSN-4961-1 0 CVEs
python-pip vulnerability
It was discovered that pip incorrectly handled unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository.
first May 19, 2021 -
High max 7.6USN-4960-1 1 CVE
runc vulnerability
Etienne Champetier discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount the host filesystem into the container and escalate privileges.
first May 19, 2021 -
Medium max 5.3USN-4956-1 1 CVE
python-eventlet vulnerability
It was discovered that Eventlet incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service.
first May 17, 2021 -
Critical max 9.8USN-4940-1 1 CVE
pyyaml vulnerability
It was discovered that PyYAML incorrectly handled untrusted YAML files with the FullLoader loader. A remote attacker could possibly use this issue to execute arbitrary code.
first May 10, 2021 -
UnscoredUSN-4933-1 2 CVEs
openvpn vulnerabilities
It was discovered that OpenVPN incorrectly handled certain data channel v2 packets. A remote attacker could possibly use this issue to inject packets using a victim's peer-id. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-11810) It…
first May 4, 2021 -
High max 7.5USN-4932-1 1 CVE
python-django vulnerability
It was discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwrite files in unexpected directories.
first May 4, 2021 -
UnscoredUSN-4927-1 1 CVE
file-roller vulnerability
It was discovered that File Roller incorrectly handled symlinks. An attacker could possibly use this issue to expose sensitive information.
first Apr 26, 2021 -
UnscoredUSN-4924-1 2 CVEs
dnsmasq vulnerabilities
It was discovered that Dnsmasq incorrectly handled certain wildcard synthesized NSEC records. A remote attacker could possibly use this issue to prove the non-existence of hostnames that actually exist. (CVE-2017-15107) It was discovered that Dnsmasq incorrec…
first Apr 22, 2021 -
UnscoredUSN-4923-1 2 CVEs
edk2 vulnerabilities
Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. (CVE-2021-28210) Satoshi Tanda discovered that EDK II incorrectly handled …
first Apr 20, 2021 -
UnscoredUSN-4899-2 1 CVE
spamassassin vulnerability
USN-4899-1 fixed a vulnerability in SpamAssassin. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system w…
first Apr 12, 2021 -
UnscoredUSN-4899-1 1 CVE
spamassassin vulnerability
Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially- crafted CF file, a remote attacker could possibly run arbitrary code.
first Apr 1, 2021 -
Medium max 6.1USN-4896-2 1 CVE
lxml vulnerability
USN-4896-1 fixed a vulnerability in lxml. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that lxml incorrectly handled certain HTML attributes. A remote attacker could possibly use this issue t…
first Apr 8, 2021 -
Medium max 6.1USN-4896-1 1 CVE
lxml vulnerability
It was discovered that lxml incorrectly handled certain HTML attributes. A remote attacker could possibly use this issue to perform cross-site scripting (XSS) attacks.
first Mar 30, 2021 -
Critical max 9.9USN-4895-1 2 CVEs
squid, squid3 vulnerabilities
Alex Rousskov and Amit Klein discovered that Squid incorrectly handled certain Content-Length headers. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. This issue only affected Ubuntu 2…
first Mar 29, 2021 -
High max 7.5USN-4885-1 1 CVE
pygments vulnerability
It was discovered that Pygments incorrectly handled parsing SML files. If a user or automated system were tricked into parsing a specially crafted SML file, a remote attacker could cause Pygments to hang, resulting in a denial of service.
first Mar 22, 2021 -
UnscoredUSN-4872-1 1 CVE
axel vulnerability
It was discovered that Axel did not properly verify the certificates for hostnames. An attacker could use this vulnerability to impersonate another server and obtain sensitive information.
first Mar 15, 2021 -
High max 7.8USN-4871-1 2 CVEs
targetcli-fb vulnerabilities
It was discovered that targetcli-fb did not properly manage socket permissions. A local attacker could use this issue to modify the iSCSI configuration resulting in a denial of service, obtain sensitive information or execute arbitrary code. (CVE-2020-10699) …
first Mar 15, 2021 -
High max 7.0USN-4870-1 1 CVE
bundler vulnerability
It was discovered that Bundler incorrectly created directories with insecure permissions in /tmp. An attacker could write malicious libraries to this location for later execution.
first Mar 15, 2021 -
UnscoredUSN-4862-1 1 CVE
neovim vulnerability
It was discovered that Neovim incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first Mar 15, 2021 -
UnscoredUSN-4856-1 1 CVE
golang-github-docker-docker-credential-helpers vulnerability
Jasiel Spelman discovered that docker-credential-helpers has a double free. A local attacker could use this to cause a denial of service (crash) or possibly execute arbitrary code.
first Mar 15, 2021 -
Critical max 9.8USN-4854-1 1 CVE
python-asyncssh vulnerability
Matthijs Kooijman discovered that AsyncSSH server did not properly handle authentication under certain conditions. An attacker with a specially crafted client could use this vulnerability to skip authentication of SSH sessions.
first Mar 15, 2021 -
High max 7.8USN-4840-1 2 CVEs
singularity-container vulnerabilities
It was discovered that Singularity incorrectly handled certain inputs. An attacker could possibly use this issue to obtain sensitive information. (CVE-2018-19295) It was discovered that Singularity incorrectly handled access control. An attacker could possibl…
first Mar 15, 2021 -
Critical max 9.8USN-4836-1 1 CVE
symfony vulnerability
It was discovered that Symfony through the HttpFoundation component allowed unauthorized access on a misconfigured LDAP server. A remote attacker could use this vulnerability to gain unauthorized access.
first Mar 15, 2021 -
Medium max 5.5USN-4832-1 1 CVE
plexus-archiver vulnerability
It was discovered that Plexus Archiver incorrectly handled directory traversal during extraction. An attacker could possibly use this for a Zip-Slip attack.
first Mar 15, 2021 -
UnscoredUSN-4762-1 1 CVE
openssh vulnerability
It was discovered that the OpenSSH ssh-agent incorrectly handled memory. A remote attacker able to connect to the agent could use this issue to cause it to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Mar 10, 2021 -
High max 8.0USN-4761-1 1 CVE
git vulnerability
Matheus Tavares discovered that Git incorrectly handled delay-capable clean/smudge filters when being used on case-insensitive filesystems. A remote attacker could possibly use this issue to execute arbitrary code.
first Mar 9, 2021 -
High max 7.5USN-4757-2 1 CVE
wpa vulnerability
USN-4757-1 fixed a vulnerability in wpa_supplicant and hostapd. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that wpa_supplicant did not properly handle P2P (Wi-Fi Direct) provision discovery…
first Mar 4, 2021 -
High max 7.5USN-4757-1 1 CVE
wpa vulnerability
It was discovered that wpa_supplicant did not properly handle P2P (Wi-Fi Direct) provision discovery requests in some situations. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code.
first Mar 3, 2021 -
UnscoredUSN-4747-2 1 CVE
screen vulnerability
USN-4747-1 fixed a vulnerability in screen. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Felix Weinmann discovered that GNU Screen incorrectly handled certain character sequences. A remote attacker could use t…
first Feb 24, 2021 -
UnscoredUSN-4747-1 1 CVE
screen vulnerability
Felix Weinmann discovered that GNU Screen incorrectly handled certain character sequences. A remote attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Feb 24, 2021 -
UnscoredUSN-4746-1 1 CVE
xterm vulnerability
Tavis Ormandy discovered that xterm incorrectly handled certain character sequences. A remote attacker could use this issue to cause xterm to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Feb 24, 2021