8,466 results · Feed
-
High max 7.5USN-3195-1 1 CVE
nova-lxd vulnerability
James Page discovered that Nova-LXD incorrectly set up virtual network devices when creating LXD instances. This could result in an unintended firewall configuration.
first Feb 10, 2017 -
UnscoredUSN-3192-1 2 CVEs
squid3 vulnerabilities
Saulius Lapinskas discovered that Squid incorrectly handled processing HTTP conditional requests. A remote attacker could possibly use this issue to obtain sensitive information related to other clients' browsing sessions. (CVE-2016-10002) Felix Hassert disco…
first Feb 6, 2017 -
UnscoredUSN-3189-2 2 CVEs
linux-lts-xenial vulnerabilities
USN-3189-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Mikulas Patocka discovered that the asynchrono…
first Feb 3, 2017 -
UnscoredUSN-3186-1 1 CVE
iucode-tool vulnerability
It was discovered that iucode-tool incorrectly handled certain microcodes when using the -tr loader. If a user were tricked into processing a specially crafted microcode, a remote attacker could use this issue to cause iucode-tool to crash, resulting in a den…
first Feb 1, 2017 -
UnscoredUSN-3177-2 0 CVEs
tomcat6, tomcat7 regression
USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered tha…
first Feb 2, 2017 -
UnscoredUSN-3169-4 2 CVEs
linux-snapdragon vulnerabilities
Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-9794) Andrey Ko…
first Jan 11, 2017 -
UnscoredUSN-3169-3 2 CVEs
linux-raspi2 vulnerabilities
Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-9794) Andrey Ko…
first Jan 11, 2017 -
UnscoredUSN-3169-2 3 CVEs
linux-lts-xenial vulnerabilities
USN-3169-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Dmitry Vyukov discovered that the KVM implemen…
first Jan 11, 2017 -
UnscoredUSN-3161-4 11 CVEs
linux-snapdragon vulnerabilities
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2015-8964) It was discovered that the Video For Linux Two…
first Dec 20, 2016 -
UnscoredUSN-3161-3 12 CVEs
linux-raspi2 vulnerabilities
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2015-8964) It was discovered that the Video For Linux Two…
first Dec 20, 2016 -
UnscoredUSN-3161-2 7 CVEs
linux-lts-xenial vulnerabilities
USN-3161-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Tilman Schmidt and Sasha Levin discovered a us…
first Dec 20, 2016 -
UnscoredUSN-3157-1 3 CVEs
apport vulnerabilities
Donncha O Cearbhaill discovered that the crash file parser in Apport improperly treated the CrashDB field as python code. An attacker could use this to convince a user to open a maliciously crafted crash file and execute arbitrary code with the privileges of …
first Dec 14, 2016 -
UnscoredUSN-3151-4 1 CVE
linux-raspi2 vulnerability
Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges.
first Dec 5, 2016 -
UnscoredUSN-3151-3 1 CVE
linux-snapdragon vulnerability
Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges.
first Dec 5, 2016 -
UnscoredUSN-3151-2 1 CVE
linux-lts-xenial vulnerability
USN-3151-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Philip Pettersson discovered a race condition …
first Dec 5, 2016 -
UnscoredUSN-3146-2 4 CVEs
linux-lts-xenial vulnerabilities
USN-3146-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the __get_user_asm_ex i…
first Nov 30, 2016 -
UnscoredUSN-3139-1 1 CVE
vim vulnerability
Florian Larysch discovered that the Vim text editor did not properly validate values for the 'filetype', 'syntax', and 'keymap' options. An attacker could trick a user into opening a file with specially crafted modelines and possibly execute arbitrary code wi…
first Nov 29, 2016 -
High max 7.5USN-3138-1 1 CVE
python-cryptography vulnerability
Markus Döring discovered that python-cryptography incorrectly handled certain HKDF lengths. This could result in python-cryptography returning an empty string instead of the expected derived key.
first Nov 28, 2016 -
Medium max 6.1USN-3137-1 3 CVEs
moin vulnerabilities
It was discovered that MoinMoin did not properly sanitize certain inputs, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a …
first Nov 23, 2016 -
High max 7.5USN-3132-1 1 CVE
tar vulnerability
Harry Sintonen discovered that tar incorrectly handled extracting files when path names are specified on the command line. If a user or automated system were tricked into processing a specially crafted archive, an attacker could possibly overwrite arbitrary f…
first Nov 21, 2016 -
UnscoredUSN-3130-1 5 CVEs
openjdk-7 vulnerabilities
It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification. An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. (CVE-2016-5542) It was discovered that the…
first Nov 17, 2016 -
UnscoredUSN-3128-3 1 CVE
linux-snapdragon vulnerability
Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a buffer overflow when displaying timeout events via the /proc/keys interface. A local attacker could use this to cause a denial of service (system crash).
first Nov 11, 2016 -
UnscoredUSN-3128-2 1 CVE
linux-lts-xenial vulnerability
USN-3128-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Ondrej Kozina discovered that the keyring inte…
first Nov 11, 2016 -
UnscoredUSN-3125-1 28 CVEs
qemu, qemu-kvm vulnerabilities
Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources, resulting in a denial of service. (CVE-2016-5403) Li Qiang discovered that QEMU incorrectl…
first Nov 9, 2016 -
UnscoredUSN-3121-1 5 CVEs
openjdk-8 vulnerabilities
It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5582) It was discovered that OpenJDK did no…
first Nov 3, 2016 -
Critical max 9.8USN-3120-1 3 CVEs
memcached vulnerabilities
Aleksandar Nikolic discovered that Memcached incorrectly handled certain malformed commands. A remote attacker could use this issue to cause Memcached to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 2, 2016 -
UnscoredUSN-3118-1 2 CVEs
mailman vulnerabilities
It was discovered that the Mailman administrative web interface did not protect against cross-site request forgery (CSRF) attacks. If an authenticated user were tricked into visiting a malicious website while logged into Mailman, a remote attacker could perfo…
first Nov 1, 2016 -
Critical max 9.8USN-3115-1 2 CVEs
python-django vulnerabilities
Marti Raudsepp discovered that Django incorrectly used a hardcoded password when running tests on an Oracle database. A remote attacker could possibly connect to the database while the tests are running and prevent the test user with the hardcoded password fr…
first Nov 1, 2016 -
UnscoredUSN-3114-2 0 CVEs
nginx regression
USN-3114-1 fixed a vulnerability in nginx. A packaging issue prevented nginx from being reinstalled or upgraded to a subsequent release. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Dawid Golunski discovered th…
first Oct 27, 2016 -
UnscoredUSN-3114-1 1 CVE
nginx vulnerability
Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote attacker could possibly use this issue to obtain root privileges.
first Oct 25, 2016 -
UnscoredUSN-3110-1 1 CVE
quagga vulnerability
David Lamparter discovered that Quagga incorrectly handled certain IPv6 router advertisements. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service.
first Oct 25, 2016 -
High max 7.0
linux-snapdragon vulnerability
It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges.
first Oct 20, 2016 -
High max 7.0
linux-raspi2 vulnerability
It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges.
first Oct 20, 2016 -
High max 7.0
linux-lts-xenial vulnerability
USN-3106-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a race condition existe…
first Oct 20, 2016 -
UnscoredUSN-3103-1 3 CVEs
libdbd-mysql-perl vulnerabilities
It was discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-9906) Hanno Böck discovered t…
first Oct 13, 2016 -
UnscoredUSN-3102-1 2 CVEs
quagga vulnerabilities
It was discovered that Quagga incorrectly handled dumping data. A remote attacker could possibly use a large BGP packet to cause Quagga to crash, resulting in a denial of service. (CVE-2016-4049) It was discovered that the Quagga package incorrectly set permi…
first Oct 13, 2016 -
UnscoredUSN-3099-4 3 CVEs
linux-snapdragon vulnerabilities
Vladimír Beneš discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO) processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service (system crash). (CV…
first Oct 11, 2016 -
UnscoredUSN-3099-3 3 CVEs
linux-raspi2 vulnerabilities
Vladimír Beneš discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO) processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service (system crash). (CV…
first Oct 11, 2016 -
UnscoredUSN-3099-2 3 CVEs
linux-lts-xenial vulnerabilities
USN-3099-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Vladimír Beneš discovered an unbounded recursi…
first Oct 11, 2016 -
UnscoredUSN-3096-1 18 CVEs
ntp vulnerabilities
Aanchal Malhotra discovered that NTP incorrectly handled authenticated broadcast mode. A remote attacker could use this issue to perform a replay attack. (CVE-2015-7973) Matt Street discovered that NTP incorrectly verified peer associations of symmetric keys.…
first Oct 5, 2016