8,466 results · Feed
-
UnscoredUSN-3313-2 1 CVE
linux-hwe vulnerability
USN-3313-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.10 for Ubuntu 16.04 LTS. It was discovered that a buffer overflow existed in th…
first Jun 7, 2017 -
Medium max 4.4USN-3312-2 15 CVEs
linux-lts-xenial vulnerabilities
USN-3312-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the netfilter netlink i…
first Jun 7, 2017 -
UnscoredUSN-3310-1 1 CVE
lintian vulnerability
Jakub Wilk discovered that lintian incorrectly handled deserializing certain YAML files. If a user or automated system were tricked into running lintian on a specially crafted package, a remote attacker could possibly use this issue to execute arbitrary code.
first Jun 6, 2017 -
UnscoredUSN-3304-1 1 CVE
sudo vulnerability
It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to determine its controlling tty. A local attacker in some configurations could possibly use this to overwrite any file on the filesystem, bypassing intended p…
first May 30, 2017 -
High max 7.5USN-3301-1 2 CVEs
strongswan vulnerabilities
It was discovered that the strongSwan gmp plugin incorrectly validated RSA public keys. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2017-9022) It was discovered that strongSwan incorrectly parsed…
first May 30, 2017 -
Critical max 9.8USN-3300-1 1 CVE
juju-core vulnerability
Ryan Beisner discovered juju did not set permissions on a Unix domain socket. A local attacker could use this flaw to gain administrative privileges.
first May 26, 2017 -
Medium max 6.2USN-3294-1 3 CVEs
bash vulnerabilities
Bernd Dietzel discovered that Bash incorrectly expanded the hostname when displaying the prompt. If a remote attacker were able to modify a hostname, this flaw could be exploited to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.…
first May 17, 2017 -
UnscoredUSN-3292-2 1 CVE
linux-hwe vulnerability
USN-3292-1 fixed a vulnerability in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.10 for Ubuntu 16.04 LTS. Jason Donenfeld discovered a heap overflow in the MACs…
first May 17, 2017 -
UnscoredUSN-3291-3 4 CVEs
linux-lts-xenial vulnerabilities
USN-3291-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Dmitry Vyukov discovered that the generic SCSI…
first May 17, 2017 -
UnscoredUSN-3291-2 4 CVEs
linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities
USN-3291-1 fixed vulnerabilities in the generic Linux kernel. This update provides the corresponding updates for the Linux kernel built for specific processors and cloud environments. Dmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux …
first May 17, 2017 -
UnscoredUSN-3289-1 6 CVEs
qemu vulnerabilities
Li Qiang discovered that QEMU incorrectly handled VirtFS directory sharing. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-7377, CVE-2017-8086) Jiangxin discovered that QEMU inco…
first May 16, 2017 -
UnscoredUSN-3287-1 1 CVE
git vulnerability
Timo Schmid discovered that the Git restricted shell incorrectly filtered allowed commands. A remote attacker could possibly use this issue to run an interactive pager and access sensitive information.
first May 15, 2017 -
UnscoredUSN-3276-2 0 CVEs
shadow regression
USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. We apologize for the inconvenience. Original advisory details: Sebastian Krahmer discovered integer overflows …
first May 17, 2017 -
Medium max 5.5USN-3276-1 2 CVEs
shadow vulnerabilities
Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain privileges via crafted input. (CVE-2016-6252) Tobias Stöckmann discovered a race condition in su. A local attacker coul…
first May 5, 2017 -
UnscoredUSN-3275-3 0 CVEs
openjdk-7 regression
USN-3275-2 fixed vulnerabilities in OpenJDK 7. Unfortunately, the update introduced a regression when handling TLS handshakes. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenJDK imprope…
first May 18, 2017 -
UnscoredUSN-3275-2 6 CVEs
openjdk-7 vulnerabilities
USN-3275-1 fixed vulnerabilities in OpenJDK 8. This update provides the corresponding updates for OpenJDK 7. Original advisory details: It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possi…
first May 15, 2017 -
UnscoredUSN-3275-1 6 CVEs
openjdk-8 vulnerabilities
It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509) It was discovered …
first May 11, 2017 -
UnscoredUSN-3266-2 1 CVE
linux-hwe vulnerability
USN-3266-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.10 for Ubuntu 16.04 LTS. Alexander Popov discovered that a race condition exist…
first Apr 25, 2017 -
UnscoredUSN-3265-2 10 CVEs
linux-lts-xenial vulnerabilities
USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a use-after-free flaw e…
first Apr 25, 2017 -
High max 7.6USN-3261-1 37 CVEs
qemu vulnerabilities
Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-1002…
first Apr 20, 2017 -
UnscoredUSN-3256-2 1 CVE
linux-hwe, linux-lts-trusty, linux-lts-xenial vulnerability
USN-3256-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel for each of the respective prior Ubuntu LTS releases. …
first Apr 5, 2017 -
Medium max 6.1USN-3254-1 2 CVEs
python-django vulnerabilities
It was discovered that Django incorrectly handled numeric redirect URLs. A remote attacker could possibly use this issue to perform XSS attacks, and to use a Django server as an open redirect. (CVE-2017-7233) Phithon Gong discovered that Django incorrectly ha…
first Apr 4, 2017 -
UnscoredUSN-3253-2 0 CVEs
nagios3 regression
USN-3253-1 fixed vulnerabilities in Nagios. The update prevented log files from being displayed in the web interface. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Nagios incorrectly handl…
first Jun 7, 2017 -
UnscoredUSN-3253-1 4 CVEs
nagios3 vulnerabilities
It was discovered that Nagios incorrectly handled certain long strings. A remote authenticated attacker could use this issue to cause Nagios to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2013-7108, CVE-2013-7205) I…
first Apr 3, 2017 -
UnscoredUSN-3251-2 1 CVE
linux-hwe vulnerability
USN-3251-1 fixed a vulnerability in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.10 for Ubuntu 16.04 LTS. It was discovered that the xfrm framework for transfor…
first Mar 30, 2017 -
UnscoredUSN-3249-2 1 CVE
linux-lts-xenial vulnerability
USN-3249-1 fixed a vulnerability in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the xfrm framework for …
first Mar 30, 2017 -
UnscoredUSN-3246-1 1 CVE
eject vulnerability
Ilja Van Sprundel discovered that dmcrypt-get-device incorrectly checked setuid and setgid return values. A local attacker could use this issue to execute code as an administrator.
first Mar 27, 2017 -
UnscoredUSN-3243-1 1 CVE
git vulnerability
It was discovered that Git incorrectly sanitized branch names in the PS1 variable when configured to display the repository status in the shell prompt. If a user were tricked into exploring a malicious repository, a remote attacker could use this issue to exe…
first Mar 23, 2017 -
UnscoredUSN-3234-2 2 CVEs
linux-lts-xenial vulnerabilities
USN-3234-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Ralf Spenneberg discovered that the ext4 imple…
first Mar 15, 2017 -
High max 7.8USN-3230-1 3 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain compressed text chunks in PNG images. A remote attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-96…
first Mar 13, 2017 -
UnscoredUSN-3221-2 1 CVE
linux-hwe vulnerability
USN-3221-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.10 for Ubuntu 16.04 LTS. Alexander Popov discovered that the N_HDLC line discip…
first Mar 8, 2017 -
UnscoredUSN-3220-3 1 CVE
linux-aws vulnerability
USN-3220-1 fixed a vulnerability in the Linux kernel. This update provides the corresponding updates for the Linux kernel for Amazon Web Services (AWS). Alexander Popov discovered that the N_HDLC line discipline implementation in the Linux kernel contained a …
first Mar 9, 2017 -
UnscoredUSN-3220-2 1 CVE
linux-lts-xenial vulnerability
USN-3220-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Alexander Popov discovered that the N_HDLC lin…
first Mar 8, 2017 -
UnscoredUSN-3215-2 0 CVEs
munin regression
USN-3215-1 fixed a vulnerability in Munin. The upstream patch caused a regression leading to errors being appended to the log file. This update fixes the problem. Original advisory details: It was discovered that Munin incorrectly handled CGI graphs. A remote…
first Mar 3, 2017 -
UnscoredUSN-3215-1 1 CVE
munin vulnerability
It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to overwrite arbitrary files as the www-data user.
first Mar 2, 2017 -
High max 8.8USN-3214-1 33 CVEs
w3m vulnerabilities
A large number of security issues were discovered in the w3m browser. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial …
first Mar 2, 2017 -
UnscoredUSN-3208-2 7 CVEs
linux-lts-xenial vulnerabilities
USN-3208-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the generic SCSI block …
first Feb 22, 2017 -
UnscoredUSN-3205-1 41 CVEs
tcpdump vulnerabilities
It was discovered that tcpdump incorrectly handled certain packets. A remote attacker could use this issue to cause tcpdump to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, attackers would be isolate…
first Feb 21, 2017 -
Critical max 9.8USN-3199-2 1 CVE
Python Crypto regression
USN-3199-1 fixed a vulnerability in the Python Cryptography Toolkit. Unfortunately, various programs depended on the original behavior of the Python Cryptography Toolkit which was altered when fixing the vulnerability. This update retains the fix for the vuln…
first Feb 17, 2017 -
Critical max 9.8USN-3199-1 1 CVE
Python Crypto vulnerability
It was discovered that the ALGnew function in block_templace.c in the Python Cryptography Toolkit contained a heap-based buffer overflow vulnerability. A remote attacker could use this flaw to execute arbitrary code by using a crafted initialization vector pa…
first Feb 16, 2017