8,466 results · Feed
-
UnscoredUSN-2788-2 0 CVEs
unzip regression
USN-2788-1 fixed vulnerabilities in unzip. One of the security patches caused a regression when extracting 0-byte files. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Gustavo Grieco discovered that unzip incorre…
first Nov 9, 2015 -
UnscoredUSN-2788-1 2 CVEs
unzip vulnerabilities
Gustavo Grieco discovered that unzip incorrectly handled certain password protected archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code. (CVE-2015-7696) Gustav…
first Oct 29, 2015 -
UnscoredUSN-2784-1 18 CVEs
openjdk-7 vulnerabilities
Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2015-4805, CVE-2015-48…
first Oct 28, 2015 -
UnscoredUSN-2783-1 18 CVEs
ntp vulnerabilities
Aleksis Kauppinen discovered that NTP incorrectly handled certain remote config packets. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2015-5146) Mir…
first Oct 27, 2015 -
High max 7.4USN-2782-1 1 CVE
apport vulnerability
Gabriel Campana discovered that Apport incorrectly handled Python module imports. A local attacker could use this issue to elevate privileges.
first Oct 27, 2015 -
UnscoredUSN-2778-1 4 CVEs
linux-lts-vivid vulnerabilities
It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to th…
first Oct 20, 2015 -
UnscoredUSN-2777-1 5 CVEs
linux-lts-utopic vulnerabilities
It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service (system crash) or possibly execute code with administrative pri…
first Oct 20, 2015 -
UnscoredUSN-2770-1 7 CVEs
oxide-qt vulnerabilities
It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass…
first Oct 20, 2015 -
UnscoredUSN-2769-1 4 CVEs
commons-httpclient vulnerabilities
It was discovered that Apache Commons HttpClient did not properly verify the Common Name or subjectAltName fields of X.509 certificates. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted …
first Oct 14, 2015 -
UnscoredUSN-2765-1 1 CVE
linux-lts-vivid vulnerability
Dmitry Vyukov discovered that the Linux kernel did not properly initialize IPC object state in certain situations. A local attacker could use this to escalate their privileges, expose confidential information, or cause a denial of service (system crash).
first Oct 5, 2015 -
UnscoredUSN-2764-1 1 CVE
linux-lts-utopic vulnerability
Dmitry Vyukov discovered that the Linux kernel did not properly initialize IPC object state in certain situations. A local attacker could use this to escalate their privileges, expose confidential information, or cause a denial of service (system crash).
first Oct 5, 2015 -
UnscoredUSN-2757-1 2 CVEs
oxide-qt vulnerabilities
Two security issues were discovered in Blink and V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to bypass same-origin restrictions. (CVE-2015-1303, CVE-2015-1304)
first Oct 5, 2015 -
UnscoredUSN-2756-1 1 CVE
rpcbind vulnerability
It was discovered that rpcbind incorrectly handled certain memory structures. A remote attacker could use this issue to cause rpcbind to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Sep 30, 2015 -
UnscoredUSN-2751-1 2 CVEs
linux-lts-vivid vulnerabilities
Benjamin Randazzo discovered an information leak in the md (multiple device) driver when the bitmap_info.file is disabled. A local privileged attacker could use this to obtain sensitive information from the kernel. (CVE-2015-5697) Marc-André Lureau discovered…
first Sep 29, 2015 -
UnscoredUSN-2750-1 1 CVE
linux-lts-utopic vulnerability
It was discovered that an integer overflow error existed in the SCSI generic (sg) driver in the Linux kernel. A local attacker with write permission to a SCSI generic device could use this to cause a denial of service (system crash) or potentially escalate th…
first Sep 29, 2015 -
UnscoredUSN-2746-2 0 CVEs
simplestreams regression
USN-2746-1 fixed a vulnerability in Simple Streams. The update caused a regression preventing MAAS from downloading PXE images. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Simple Streams…
first Sep 25, 2015 -
UnscoredUSN-2746-1 1 CVE
simplestreams vulnerability
It was discovered that Simple Streams did not properly perform gpg verification in some situations. A remote attacker could use this to perform a machine-in-the-middle attack and inject malicious content into the stream.
first Sep 24, 2015 -
UnscoredUSN-2745-1 5 CVEs
qemu, qemu-kvm vulnerabilities
Lian Yihan discovered that QEMU incorrectly handled certain payload messages in the VNC display driver. A malicious guest could use this issue to cause the QEMU process to hang, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and U…
first Sep 24, 2015 -
UnscoredUSN-2744-1 1 CVE
apport vulnerability
Halfdog discovered that Apport incorrectly handled kernel crash dump files. A local attacker could use this issue to cause a denial of service, or possibly elevate privileges. The default symlink protections for affected releases should reduce the vulnerabili…
first Sep 24, 2015 -
UnscoredUSN-2743-3 0 CVEs
unity-firefox-extension, webapps-greasemonkey, webaccounts-browser-extension update
USN-2743-1 fixed vulnerabilities in Firefox. Future Firefox updates will require all addons be signed and unity-firefox-extension, webapps-greasemonkey and webaccounts-browser-extension will not go through the signing process. Because these addons currently b…
first Sep 24, 2015 -
UnscoredUSN-2743-2 0 CVEs
ubufox update
USN-2743-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Ubufox. Original advisory details: Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Bob Clary and …
first Sep 22, 2015 -
UnscoredUSN-2737-1 1 CVE
linux-lts-vivid vulnerability
It was discovered that an integer overflow error existed in the SCSI generic (sg) driver in the Linux kernel. A local attacker with write permission to a SCSI generic device could use this to cause a denial of service (system crash) or potentially escalate th…
first Sep 9, 2015 -
UnscoredUSN-2735-1 8 CVEs
oxide-qt vulnerabilities
It was discovered that the DOM tree could be corrupted during parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions or cause a denial of s…
first Sep 8, 2015 -
UnscoredUSN-2724-1 3 CVEs
qemu, qemu-kvm vulnerabilities
It was discovered that QEMU incorrectly handled a PRDT with zero complete sectors in the IDE functionality. A malicious guest could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014…
first Aug 27, 2015 -
High max 7.5USN-2720-1 2 CVEs
python-django vulnerability
Lin Hua Cheng discovered that Django incorrectly handled the session store. A remote attacker could use this issue to cause the session store to fill up, resulting in a denial of service.
first Aug 18, 2015 -
UnscoredUSN-2718-1 1 CVE
linux-lts-vivid vulnerability
Marcelo Ricardo Leitner discovered a race condition in the Linux kernel's SCTP address configuration lists when using Address Configuration Change (ASCONF) options on a socket. An unprivileged local user could exploit this flaw to cause a denial of service (s…
first Aug 18, 2015 -
UnscoredUSN-2717-1 1 CVE
linux-lts-utopic vulnerability
Marcelo Ricardo Leitner discovered a race condition in the Linux kernel's SCTP address configuration lists when using Address Configuration Change (ASCONF) options on a socket. An unprivileged local user could exploit this flaw to cause a denial of service (s…
first Aug 18, 2015 -
UnscoredUSN-2710-2 0 CVEs
openssh regression
USN-2710-1 fixed vulnerabilities in OpenSSH. The upstream fix for CVE-2015-5600 caused a regression resulting in random authentication failures in non-default configurations. This update fixes the problem. Original advisory details: Moritz Jodeit discovered t…
first Aug 18, 2015 -
UnscoredUSN-2709-2 0 CVEs
pollinate update
USN-2709-1 updated pollinate's certificate for entropy.ubuntu.com but did not include a new certificate authority certificate. This update fixes the problem. We apologize for the inconvenience. Original advisory details: The pollinate package bundles the cert…
first Oct 14, 2015 -
UnscoredUSN-2709-1 0 CVEs
pollinate update
The pollinate package bundles the certificate for entropy.ubuntu.com. This update refreshes the certificate to match the new certificate for the server.
first Aug 14, 2015 -
High max 7.5USN-2705-1 2 CVEs
python-keystoneclient, python-keystonemiddleware vulnerabilities
Qin Zhao discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certific…
first Aug 6, 2015 -
UnscoredUSN-2704-1 2 CVEs
swift vulnerabilities
Rajaneesh Singh discovered Swift does not properly enforce metadata limits. An attacker could abuse this issue to store more metadata than allowed by policy. (CVE-2014-7960) Clay Gerrard discovered Swift allowed users to delete the latest version of object re…
first Aug 6, 2015 -
UnscoredUSN-2702-2 0 CVEs
ubufox update
USN-2702-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubufox. Original advisory details: Gary Kwong, Christian Holler, Byron Campen, Tyson Smith, Bobby Holley, Chris Coulson, and Eric Rahm discovered multiple memory s…
first Aug 11, 2015 -
UnscoredUSN-2692-1 2 CVEs
qemu vulnerabilities
Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a non-default configuration, a malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the …
first Jul 28, 2015 -
UnscoredUSN-2690-1 4 CVEs
linux-lts-vivid vulnerabilities
Andy Lutomirski discovered a flaw in the Linux kernel's handling of nested NMIs (non-maskable interrupts). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges. (CVE-2015-3290)…
first Jul 28, 2015 -
UnscoredUSN-2689-1 4 CVEs
linux-lts-utopic vulnerabilities
Andy Lutomirski discovered a flaw in the Linux kernel's handling of nested NMIs (non-maskable interrupts). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges. (CVE-2015-3290)…
first Jul 28, 2015 -
UnscoredUSN-2683-1 4 CVEs
linux-lts-vivid vulnerabilities
A flaw was discovered in the kvm (kernel virtual machine) subsystem's kvm_apic_has_events function. A unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4692) Daniel Borkmann reported a kernel crash in the L…
first Jul 23, 2015 -
UnscoredUSN-2682-1 3 CVEs
linux-lts-utopic vulnerabilities
A flaw was discovered in the kvm (kernel virtual machine) subsystem's kvm_apic_has_events function. A unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4692) A flaw was discovered in how the Linux kernel ha…
first Jul 23, 2015 -
UnscoredUSN-2676-1 3 CVEs
nbd vulnerabilities
It was discovered that NBD incorrectly handled IP address matching. A remote attacker could use this issue with an IP address that has a partial match and bypass access restrictions. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-6410) Tuomas Räsänen di…
first Jul 22, 2015 -
High max 7.5USN-2671-1 2 CVEs
python-django vulnerabilities
Eric Peterson and Lin Hua Cheng discovered that Django incorrectly handled session records. A remote attacker could use this issue to cause a denial of service. (CVE-2015-5143) Sjoerd Job Postmus discovered that DJango incorrectly handled newline characters w…
first Jul 9, 2015