8,466 results · Feed
-
UnscoredUSN-3509-4 0 CVEs
linux-lts-xenial, linux-aws regression
USN-3509-2 fixed vulnerabilities in the Linux Hardware Enablement kernel for Ubuntu 14.04 LTS. Unfortunately, it also introduced a regression that prevented the Ceph network filesystem from being used. This update fixes the problem. We apologize for the incon…
first Dec 15, 2017 -
UnscoredUSN-3509-2 4 CVEs
linux-lts-xenial, linux-aws vulnerabilities
USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Mohamed Ghannam discovered that a use-after-fr…
first Dec 7, 2017 -
UnscoredUSN-3508-2 3 CVEs
linux-hwe vulnerabilities
USN-3508-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. Mohamed Ghannam discovered that a use-after-free vulne…
first Dec 7, 2017 -
UnscoredUSN-3507-2 6 CVEs
linux-gcp vulnerabilities
Mohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16939) It was…
first Dec 8, 2017 -
UnscoredUSN-3506-1 2 CVEs
rsync vulnerabilities
It was discovered that rsync proceeds with certain file metadata updates before checking for a filename. An attacker could use this to bypass access restrictions. (CVE-2017-17433) It was discovered that rsync does not check for fnamecmp filenames and also doe…
first Dec 7, 2017 -
UnscoredUSN-3505-1 2 CVEs
linux-firmware vulnerabilities
Mathy Vanhoef discovered that the firmware for several Intel WLAN devices incorrectly handled WPA2 in relation to Wake on WLAN. A remote attacker could use this issue with key reinstallation attacks to obtain sensitive information. (CVE-2017-13080, CVE-2017-1…
first Dec 6, 2017 -
UnscoredUSN-3497-1 14 CVEs
openjdk-7 vulnerabilities
It was discovered that the Smart Card IO subsystem in OpenJDK did not properly maintain state. An attacker could use this to specially construct an untrusted Java application or applet to gain access to a smart card, bypassing sandbox restrictions. (CVE-2017-…
first Nov 29, 2017 -
UnscoredUSN-3495-1 1 CVE
optipng vulnerability
It was discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause OptiPNG to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 27, 2017 -
UnscoredUSN-3494-1 1 CVE
libxml-libxml-perl vulnerability
It was discovered that XML::LibXML incorrectly handled memory when processing a replaceChild call. A remote attacker could possibly use this issue to execute arbitrary code.
first Nov 27, 2017 -
UnscoredUSN-3488-1 1 CVE
linux-azure vulnerability
It was discovered that the KVM subsystem in the Linux kernel did not properly keep track of nested levels in guest page tables. A local attacker in a guest VM could use this to cause a denial of service (host OS crash) or possibly execute arbitrary code in th…
first Nov 21, 2017 -
UnscoredUSN-3485-3 13 CVEs
linux-aws vulnerabilities
It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-…
first Nov 21, 2017 -
UnscoredUSN-3485-2 13 CVEs
linux-lts-xenial vulnerabilities
USN-3485-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a race condition existe…
first Nov 21, 2017 -
UnscoredUSN-3484-3 1 CVE
linux-gcp vulnerability
It was discovered that the KVM subsystem in the Linux kernel did not properly keep track of nested levels in guest page tables. A local attacker in a guest VM could use this to cause a denial of service (host OS crash) or possibly execute arbitrary code in th…
first Nov 21, 2017 -
UnscoredUSN-3484-2 1 CVE
linux-hwe vulnerability
USN-3484-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. It was discovered that the KVM subsystem in the Linux …
first Nov 21, 2017 -
UnscoredUSN-3483-1 1 CVE
procmail vulnerability
Jakub Wilk discovered that the formail tool incorrectly handled certain malformed mail messages. An attacker could use this flaw to cause formail to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 20, 2017 -
UnscoredUSN-3480-3 0 CVEs
apport regression
USN-3480-2 fixed regressions in Apport. The update introduced a new regression in the container support. This update addresses the problem. We apologize for the inconvenience. Original advisory details: Sander Bos discovered that Apport incorrectly handled co…
first Jan 3, 2018 -
UnscoredUSN-3480-2 0 CVEs
apport regressions
USN-3480-1 fixed vulnerabilities in Apport. The fix for CVE-2017-14177 introduced a regression in the ability to handle crashes for users that configured their systems to use the Upstart init system in Ubuntu 16.04 LTS and Ubuntu 17.04. The fix for CVE-2017-1…
first Nov 20, 2017 -
UnscoredUSN-3480-1 2 CVEs
apport vulnerabilities
Sander Bos discovered that Apport incorrectly handled core dumps for setuid binaries. A local attacker could use this issue to perform a denial of service via resource exhaustion or possibly gain root privileges. (CVE-2017-14177) Sander Bos discovered that Ap…
first Nov 15, 2017 -
UnscoredUSN-3476-1 2 CVEs
postgresql-common vulnerabilities
Dawid Golunski discovered that the postgresql-common pg_ctlcluster script incorrectly handled symlinks. A local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-1255) It w…
first Nov 9, 2017 -
UnscoredUSN-3473-1 14 CVEs
openjdk-8 vulnerabilities
It was discovered that the Smart Card IO subsystem in OpenJDK did not properly maintain state. An attacker could use this to specially construct an untrusted Java application or applet to gain access to a smart card, bypassing sandbox restrictions. (CVE-2017-…
first Nov 8, 2017 -
UnscoredUSN-3471-1 2 CVEs
quagga vulnerabilities
Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service. (CVE-2017-16227) Quentin Young discovered that Quagga incorrectly…
first Oct 31, 2017 -
UnscoredUSN-3469-2 12 CVEs
linux-lts-xenial vulnerabilities
USN-3469-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Anthony Perard discovered that the Xen virtual…
first Oct 31, 2017 -
UnscoredUSN-3468-3 5 CVEs
linux-gcp vulnerabilities
It was discovered that the KVM subsystem in the Linux kernel did not properly bound guest IRQs. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2017-1000252) It was discovered that the Flash-Friendly File S…
first Oct 31, 2017 -
UnscoredUSN-3468-2 5 CVEs
linux-hwe vulnerabilities
USN-3468-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. It was discovered that the KVM subsystem in the Linux …
first Oct 31, 2017 -
High max 8.8USN-3464-1 4 CVEs
wget vulnerabilities
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget incorrectly handled certain HTTP responses. A remote attacker could use this issue to cause Wget to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017…
first Oct 26, 2017 -
Medium max 6.1USN-3463-1 1 CVE
python-werkzeug vulnerability
It was discovered that Werkzeug did not properly handle certain web scripts. A remote attacker could use this to inject arbitrary code via a field that contains an exception message.
first Oct 25, 2017 -
UnscoredUSN-3455-1 11 CVEs
wpa vulnerabilities
Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectly handled WPA2. A remote attacker could use this issue with key reinstallation attacks to obtain sensitive information. (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-201…
first Oct 16, 2017 -
High max 7.5USN-3451-1 3 CVEs
swift vulnerabilities
It was discovered that OpenStack Swift incorrectly handled tempurls. A remote authenticated user in possession of a tempurl key authorized for PUT could retrieve other objects in the same Swift account. (CVE-2015-5223) Romain Le Disez and Örjan Persson discov…
first Oct 11, 2017 -
UnscoredUSN-3450-1 3 CVEs
openvswitch vulnerabilities
Bhargava Shastry discovered that Open vSwitch incorrectly handled certain OFP messages. A remote attacker could possibly use this issue to cause Open vSwitch to crash, resulting in a denial of service. (CVE-2017-9214) It was discovered that Open vSwitch incor…
first Oct 11, 2017 -
High max 7.5USN-3449-1 7 CVEs
nova vulnerabilities
George Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-3241) George Shuklin and Tushar Patil discovered that O…
first Oct 11, 2017 -
Medium max 6.8USN-3448-1 1 CVE
keystone vulnerability
Boris Bobrov discovered that OpenStack Keystone incorrectly handled federation mapping when there are rules in which group-based assignments are not used. A remote authenticated user may receive all the roles assigned to a project regardless of the federation…
first Oct 11, 2017 -
Medium max 5.4USN-3447-1 1 CVE
horizon vulnerability
Beth Lancaster and Brandon Sawyers discovered that OpenStack Horizon was incorrect protected against cross-site scripting (XSS) attacks. A remote authenticated user could use this issue to inject web script or HTML in a dashboard form.
first Oct 11, 2017 -
Medium max 4.3USN-3446-1 3 CVEs
glance vulnerabilities
Hemanth Makkapati discovered that OpenStack Glance incorrectly handled access restrictions. A remote authenticated user could use this issue to change the status of images, contrary to access restrictions. (CVE-2015-5251) Mike Fedosin and Alexei Galkin discov…
first Oct 11, 2017 -
UnscoredUSN-3444-2 3 CVEs
linux-lts-xenial vulnerabilities
USN-3444-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jan H. Schönherr discovered that the Xen subsy…
first Oct 10, 2017 -
UnscoredUSN-3443-3 1 CVE
linux-gcp vulnerability
Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-14106)
first Oct 11, 2017 -
UnscoredUSN-3443-2 2 CVEs
linux-hwe vulnerabilities
USN-3443-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. It was discovered that on the PowerPC architecture, th…
first Oct 10, 2017 -
UnscoredUSN-3438-1 1 CVE
git vulnerability
It was discovered that Git incorrectly handled certain subcommands such as cvsserver. A remote attacker could possibly use this issue via shell metacharacters in modules names to execute arbitrary code. This update also removes the cvsserver subcommand from g…
first Oct 5, 2017 -
UnscoredUSN-3437-1 1 CVE
ocaml vulnerability
Radek Micek discovered that OCaml incorrectly handled sign extensions. A remote attacker could use this issue to cause applications using OCaml to crash, to possibly obtain sensitive information, or to possibly execute arbitrary code.
first Oct 3, 2017 -
UnscoredUSN-3432-1 0 CVEs
ca-certificates update
The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 20170717 package.
first Oct 2, 2017 -
UnscoredUSN-3430-1 6 CVEs
dnsmasq vulnerabilities
Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly handled DNS requests. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service, or possibly execute arbitrary code…
first Oct 2, 2017