8,466 results · Feed
-
UnscoredUSN-4482-1 1 CVE
ark vulnerability
Fabian Vogt discovered that Ark incorrectly handled symbolic links in tar archive files. An attacker could use this to construct a malicious tar archive that, when opened, would create files outside the extraction directory.
first Sep 1, 2020 -
High max 7.5USN-4479-1 2 CVEs
python-django vulnerabilities
It was discovered that Django, when used with Python 3.7 or higher, incorrectly handled directory permissions. A local attacker could possibly use this issue to obtain sensitive information, or escalate permissions.
first Sep 1, 2020 -
High max 7.5USN-4478-1 1 CVE
python-rsa vulnerability
It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issue to obtain sensitive information.
first Aug 31, 2020 -
High max 8.6USN-4477-1 3 CVEs
squid vulnerabilities
Amit Klein discovered that Squid incorrectly validated certain data. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. (CVE-2020-15810) Régis Leroy discovered that Squid incorrectly vali…
first Aug 27, 2020 -
UnscoredUSN-4467-3 0 CVEs
qemu regression
USN-4467-1 fixed vulnerabilities in QEMU. The fix for CVE-2020-13754 introduced a regression in certain environments. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Ren Ding, Hanqing Zhao, Alexander Bulekov, and …
first Feb 22, 2021 -
UnscoredUSN-4467-2 6 CVEs
qemu vulnerabilities
USN-4467-1 fixed several vulnerabilities in QEMU. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that the QEMU SD memory card implementation incorrectly handled certain memory operations. An at…
first Feb 2, 2021 -
UnscoredUSN-4464-1 1 CVE
gnome-shell vulnerability
It was discovered that GNOME Shell incorrectly handled the login screen password dialog. Sensitive information could possibly be exposed during user logout.
first Aug 18, 2020 -
UnscoredUSN-4457-2 1 CVE
software-properties vulnerability
USN-4457-1 fixed a vulnerability in Software. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Jason A. Donenfeld discovered that Software Properties incorrectly filtered certain escape sequences when displaying P…
first Aug 17, 2020 -
UnscoredUSN-4457-1 1 CVE
software-properties vulnerability
Jason A. Donenfeld discovered that Software Properties incorrectly filtered certain escape sequences when displaying PPA descriptions. If a user were tricked into adding an arbitrary PPA, a remote attacker could possibly manipulate the screen.
first Aug 12, 2020 -
High max 8.3USN-4453-1 8 CVEs
openjdk-8 vulnerabilities
Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control contexts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-14556) Philippe Arteau discovered that OpenJDK 8 incorrectly verified names in TLS server's X.5…
first Aug 5, 2020 -
High max 7.0USN-4449-2 3 CVEs
apport vulnerabilities
USN-4449-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that Apport incorrectly dropped privilege…
first Sep 2, 2020 -
High max 7.0USN-4449-1 3 CVEs
apport vulnerabilities
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that Apport incorrectly dropped privileges when making certain D-Bus calls. A local attacker could use this issue to read arbitrary files. (CVE-2020-11936) Seong-Joong Kim discovered that …
first Aug 4, 2020 -
UnscoredUSN-4446-2 0 CVEs
squid3 regression
USN-4446-1 fixed vulnerabilities in Squid. The update introduced a regression when using Squid with the icap or ecap protocols. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jeriko One discovered that Squid inco…
first Aug 27, 2020 -
UnscoredUSN-4446-1 4 CVEs
squid3 vulnerabilities
Jeriko One discovered that Squid incorrectly handled caching certain requests. A remote attacker could possibly use this issue to perform cache-injection attacks or gain access to reverse proxy features such as ESI. (CVE-2019-12520) Jeriko One and Kristoffer …
first Aug 3, 2020 -
UnscoredUSN-4442-1 3 CVEs
sympa vulnerabilities
Michael Kaczmarczik discovered that Sympa incorrectly handled HTTP GET/POST requests. An attacker could possibly use this issue to insert, edit or obtain sensitive information. (CVE-2018-1000550) It was discovered that Sympa incorrectly handled URL parameters…
first Jul 28, 2020 -
High max 8.3USN-4433-1 8 CVEs
openjdk-lts vulnerabilities
Johannes Kuhn discovered that OpenJDK incorrectly handled access control contexts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-14556) It was discovered that OpenJDK incorrectly handled memory allocation when reading TIFF ima…
first Jul 23, 2020 -
Medium max 5.9USN-4424-1 1 CVE
snapd vulnerabilities
It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices ran on every boot without restrictions. A physical attacker could exploit this to craft cloud-init user-data/meta-data via external media to perform arbitrary c…
first Jul 15, 2020 -
High max 7.0USN-4415-1 3 CVEs
coturn vulnerabilities
Felix Dörre discovered that coTURN response buffer is not initialized properly. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-4067) It was discovered that coTURN web server incorrectly handled HTTP POST requests. An atta…
first Jul 6, 2020 -
UnscoredUSN-4406-1 1 CVE
mailman vulnerability
It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary content in the login page.
first Jun 29, 2020 -
UnscoredUSN-4405-1 1 CVE
glib-networking vulnerability
It was discovered that glib-networking skipped hostname certificate verification if the application failed to specify the server identity. A remote attacker could use this to perform a person-in-the-middle attack and expose sensitive information.
first Jun 29, 2020 -
UnscoredUSN-4403-1 1 CVE
mutt vulnerability and regression
It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to enable MITM attacks. (CVE-2020-14954) This update also address a regression caused in the last update USN-4401-1. It only affected Ubuntu 12.04 ESM,…
first Jun 24, 2020 -
UnscoredUSN-4401-1 2 CVEs
mutt vulnerabilities
It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to enable MITM attacks. (CVE-2020-14093) It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to…
first Jun 22, 2020 -
Medium max 4.9USN-4399-1 2 CVEs
bind9 vulnerabilities
It was discovered that Bind incorrectly handled large responses during zone transfers. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2020-8618) It was discovered that Bind incorrectly handled ce…
first Jun 17, 2020 -
Medium max 6.1USN-4381-2 2 CVEs
python-django vulnerabilities
USN-4381-1 fixed several vulnerabilities in Django. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Dan Palmer discovered that Django incorrectly validated memcached cache keys. A remote attacker could possibly u…
first Jun 4, 2020 -
Medium max 6.1USN-4381-1 2 CVEs
python-django vulnerabilities
Dan Palmer discovered that Django incorrectly validated memcached cache keys. A remote attacker could possibly use this issue to cause a denial of service and obtain sensitive information. (CVE-2020-13254) Jon Dufresne discovered that Django incorrectly encod…
first Jun 3, 2020 -
UnscoredUSN-4377-2 0 CVEs
ca-certificates update
USN-4377-1 updated ca-certificates. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: The ca-certificates package contained an expired CA certificate that caused connectivity issues. This updat…
first Jun 1, 2020 -
UnscoredUSN-4377-1 0 CVEs
ca-certificates update
The ca-certificates package contained an expired CA certificate that caused connectivity issues. This update removes the "AddTrust External Root" CA. In addition, on Ubuntu 16.04 LTS and Ubuntu 18.04 LTS, this update refreshes the included certificates to tho…
first Jun 1, 2020 -
UnscoredUSN-4369-2 0 CVEs
linux, linux-raspi2, linux-raspi2-5.3 regression
USN-4369-1 fixed vulnerabilities in the 5.3 Linux kernel. Unfortunately, that update introduced a regression in overlayfs. This update corrects the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the btrfs implem…
first May 28, 2020 -
UnscoredUSN-4357-1 1 CVE
iproute2 vulnerability
It was discovered that IPRoute incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.
first May 13, 2020 -
UnscoredUSN-4356-1 4 CVEs
squid, squid3 vulnerabilities
Jeriko One discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A malicious remote server could cause Squid to crash, possibly poison the cache, or possibly execute arbitrary code. (CVE-2019-12519, CVE-2019-12521) It was disco…
first May 13, 2020 -
UnscoredUSN-4354-1 1 CVE
mailman vulnerability
It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary content in the login page.
first May 11, 2020 -
UnscoredUSN-4349-1 9 CVEs
edk2 vulnerabilities
A buffer overflow was discovered in the network stack. An unprivileged user could potentially enable escalation of privilege and/or denial of service. This issue was already fixed in a previous release for 18.04 LTS and 19.10. (CVE-2018-12178) A buffer overfl…
first Apr 30, 2020 -
Medium max 6.5USN-4348-1 3 CVEs
mailman vulnerabilities
It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this to issue execute arbitrary scripts or HTML. (CVE-2018-0618) It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly us…
first Apr 29, 2020 -
UnscoredUSN-4338-2 1 CVE
re2c vulnerability
USN-4338-1 fixed vulnerabilities in re2c. This update provides the corresponding update for Ubuntu 20.04 LTS. Original advisory details: Agostino Sarubbo discovered that re2c incorrectly handled certain files. An attacker could possibly use this issue to exec…
first Apr 28, 2020 -
High max 8.3USN-4337-1 13 CVEs
openjdk-8, openjdk-lts vulnerabilities
It was discovered that OpenJDK incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted regular expression. (CVE-2020-2754, CVE-2020-2755) It was discovered th…
first Apr 22, 2020 -
Medium max 4.0USN-4334-1 1 CVE
git vulnerability
Carlo Arenas discovered that Git incorrectly handled certain URLs containing newlines, empty hosts, or lacking a scheme. A remote attacker could possibly use this issue to trick Git into returning credential information for a wrong host.
first Apr 21, 2020 -
UnscoredUSN-4332-2 1 CVE
file-roller vulnerability
USN-4332-1 fixed vulnerabilities in File Roller. This update provides the corresponding update for Ubuntu 20.04 LTS. Original advisory details: It was discovered that File Roller incorrectly handled symlinks. An attacker could possibly use this issue to expos…
first Apr 27, 2020 -
UnscoredUSN-4332-1 1 CVE
file-roller vulnerability
It was discovered that File Roller incorrectly handled symlinks. An attacker could possibly use this issue to expose sensitive information.
first Apr 20, 2020 -
Critical max 9.3USN-4329-1 1 CVE
git vulnerability
Felix Wilhelm discovered that Git incorrectly handled certain URLs that included newlines. A remote attacker could possibly use this issue to trick Git into returning credential information for a wrong host.
first Apr 14, 2020 -
UnscoredUSN-4321-1 1 CVE
haproxy vulnerability
Felix Wilhelm discovered that HAProxy incorrectly handled certain HTTP/2 requests. An attacker could possibly use this to execute arbitrary code.
first Apr 7, 2020