8,466 results · Feed
-
UnscoredUSN-2407-1 2 CVEs
nova vulnerabilities
Garth Mollett discovered that OpenStack Nova did not properly clean up an instance when using rescue mode with the VMWare driver. A remove authenticated user could exploit this to bypass intended quota limits. By default, Ubuntu does not use the VMWare driver…
first Nov 11, 2014 -
UnscoredUSN-2406-1 1 CVE
keystone vulnerability
Brant Knudson discovered that OpenStack Keystone did not properly perform input sanitization when performing endpoint catalog substitution. A remote attacker with privileged access for creating endpoints could exploit this to obtain sensitive information.
first Nov 11, 2014 -
UnscoredUSN-2405-1 2 CVEs
cinder vulnerabilities
Duncan Thomas discovered that OpenStack Cinder did not properly track the file format when using the GlusterFS of Smbfs drivers. A remote authenticated user could exploit this to potentially obtain file contents from the compute host. (CVE-2014-3641) Amrith K…
first Nov 11, 2014 -
UnscoredUSN-2393-1 1 CVE
wget vulnerability
HD Moore discovered that Wget contained a path traversal vulnerability when downloading symlinks using FTP. A malicious remote FTP server or a man in the middle could use this issue to cause Wget to overwrite arbitrary files, possibly leading to arbitrary cod…
first Oct 30, 2014 -
UnscoredUSN-2388-1 11 CVEs
openjdk-7 vulnerabilities
A vulnerability was discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit this to expose sensitive data over the network. (CVE-2014-6457) Several vulnerabilities were discovered in the OpenJDK JRE relate…
first Oct 23, 2014 -
UnscoredUSN-2387-1 0 CVEs
pollinate update
The pollinate package bundles the certificate for entropy.ubuntu.com. This update refreshes the certificate to match the one currently used on the server.
first Oct 22, 2014 -
UnscoredUSN-2383-1 1 CVE
wpa, wpasupplicant vulnerability
Jouni Malinen discovered that the wpa_cli tool incorrectly sanitized strings when being used with action scripts. A remote attacker could possibly use this issue to execute arbitrary commands.
first Oct 14, 2014 -
Medium max 5.3USN-2382-1 2 CVEs
requests vulnerabilities
Jakub Wilk discovered that Requests incorrectly reused authentication credentials after being redirected. An attacker could possibly use this issue to obtain authentication credentials intended for another site. (CVE-2014-1829, CVE-2014-1830)
first Oct 14, 2014 -
UnscoredUSN-2381-1 2 CVEs
rsyslog vulnerabilities
It was discovered that Rsyslog incorrectly handled invalid PRI values. An attacker could use this issue to send malformed messages to the Rsyslog server and cause it to stop responding, resulting in a denial of service and possibly message loss. (CVE-2014-363…
first Oct 9, 2014 -
High max 8.8
bash vulnerabilities
Michal Zalewski discovered that Bash incorrectly handled parsing certain function definitions. If an attacker were able to create an environment variable containing a function definition with a very specific name, these issues could possibly be used to bypass…
first Oct 9, 2014 -
UnscoredUSN-2371-1 1 CVE
exuberant-ctags vulnerability
It was discovered that Exuberant Ctags incorrectly handled certain minified js files. An attacker could use this issue to possibly cause Exuberant Ctags to consume resources, resulting in a denial of service.
first Oct 8, 2014 -
UnscoredUSN-2364-1 2 CVEs
bash vulnerabilities
Florian Weimer and Todd Sabin discovered that the Bash parser incorrectly handled memory. An attacker could possibly use this issue to bypass certain environment restrictions and execute arbitrary code. (CVE-2014-7186, CVE-2014-7187) In addition, this update …
first Sep 27, 2014 -
Critical max 9.8
bash vulnerability
USN-2363-1 fixed a vulnerability in Bash. Due to a build issue, the patch for CVE-2014-7169 didn't get properly applied in the Ubuntu 14.04 LTS package. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Tavis Ormand…
first Sep 26, 2014 -
Critical max 9.8
bash vulnerability
Tavis Ormandy discovered that the security fix for Bash included in USN-2362-1 was incomplete. An attacker could use this issue to bypass certain environment restrictions. (CVE-2014-7169)
first Sep 25, 2014 -
Critical max 9.8
bash vulnerability
Stephane Chazelas discovered that Bash incorrectly handled trailing code in function definitions. An attacker could use this issue to bypass environment restrictions, such as SSH forced command environments.
first Sep 24, 2014 -
UnscoredUSN-2351-1 1 CVE
nginx vulnerability
Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certain configurations to obtain access to information from a different virtual host.
first Sep 22, 2014 -
High max 7.5USN-2347-1 4 CVEs
python-django vulnerabilities
Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. (CVE-2014-0480) David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use …
first Sep 16, 2014 -
UnscoredUSN-2345-1 12 CVEs
oxide-qt vulnerabilities
Multiple use-after-free issues were discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash, or execute arbitrary code with the privileg…
first Oct 14, 2014 -
UnscoredUSN-2342-1 32 CVEs
qemu, qemu-kvm vulnerabilities
Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple issues with QEMU state loading after migration. An attacker able to modify the state data could use these issues to cause a denial of service, or possibly execute arbitrary code. (CVE-2…
first Sep 8, 2014 -
UnscoredUSN-2340-1 1 CVE
procmail vulnerability
Tavis Ormandy discovered that the formail tool incorrectly handled certain malformed mail headers. An attacker could use this flaw to cause formail to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Sep 4, 2014 -
UnscoredUSN-2327-1 1 CVE
squid3 vulnerability
Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service.
first Aug 28, 2014 -
UnscoredUSN-2326-1 6 CVEs
oxide-qt vulnerabilities
A use-after-free was discovered in the SVG implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with th…
first Sep 2, 2014 -
UnscoredUSN-2325-1 1 CVE
nova vulnerability
Alex Gaynor discovered that OpenStack Nova would sometimes respond with variable times when comparing authentication tokens. If nova were configured to proxy metadata requests via Neutron, a remote authenticated attacker could exploit this to conduct timing a…
first Aug 21, 2014 -
Medium max 6.5USN-2324-1 5 CVEs
keystone vulnerabilities
Steven Hardy discovered that OpenStack Keystone did not properly handle chained delegation. A remove authenticated attacker could use this to gain privileges by creating a new token with additional roles. (CVE-2014-3476) Jamie Lennox discovered that OpenStack…
first Aug 21, 2014 -
UnscoredUSN-2323-1 4 CVEs
horizon vulnerabilities
Jason Hullinger discovered that OpenStack Horizon did not properly perform input sanitization on Heat templates. If a user were tricked into using a specially crafted Heat template, an attacker could conduct cross-site scripting attacks. With cross-site scrip…
first Aug 21, 2014 -
UnscoredUSN-2322-1 1 CVE
glance vulnerability
Thomas Leaman and Stuart McLaren discovered that OpenStack Glance did not properly honor the image_size_cap configuration option. A remote authenticated attacker could exploit this to cause a denial of service via disk consumption.
first Aug 21, 2014 -
UnscoredUSN-2321-1 2 CVEs
neutron vulnerabilities
Liping Mao discovered that OpenStack Neutron did not properly handle requests for a large number of allowed address pairs. A remote authenticated attacker could exploit this to cause a denial of service. (CVE-2014-3555) Zhi Kun Liu discovered that OpenStack N…
first Aug 21, 2014 -
UnscoredUSN-2320-1 3 CVEs
oxide-qt vulnerabilities
A use-after-free was discovered in the websockets implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2014-3165) An issue w…
first Aug 20, 2014 -
UnscoredUSN-2319-3 0 CVEs
openjdk-7 update
USN-2319-1 fixed vulnerabilities in OpenJDK 7. This update provides stability fixes for the arm64 and ppc64el architectures. Original advisory details: Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrit…
first Sep 17, 2014 -
UnscoredUSN-2319-2 0 CVEs
openjdk-7 regression
USN-2319-1 fixed vulnerabilities in OpenJDK 7. Due to an upstream regression, verifying of the init method call would fail when it was done from inside a branch when stack frames are activated. This update fixes the problem. We apologize for the inconvenience…
first Aug 26, 2014 -
UnscoredUSN-2319-1 11 CVEs
openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-2483, CVE-2014-249…
first Aug 20, 2014 -
UnscoredUSN-2311-2 1 CVE
ceilometer vulnerability
USN-2311-1 fixed vulnerabilities in pyCADF. This update provides the corresponding updates for OpenStack Ceilometer. Original advisory details: Zhi Kun Liu discovered that pyCADF incorrectly filtered certain tokens. An attacker could possibly use this issue t…
first Aug 21, 2014 -
UnscoredUSN-2311-1 1 CVE
python-pycadf vulnerability
Zhi Kun Liu discovered that pyCADF incorrectly filtered certain tokens. An attacker could possibly use this issue to obtain authentication tokens used in REST requests.
first Aug 11, 2014 -
UnscoredUSN-2302-1 3 CVEs
tomcat6, tomcat7 vulnerabilities
David Jorm discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to consume resources, resulting in a denial of service. (CVE-2014-0075) It was d…
first Jul 30, 2014 -
UnscoredUSN-2298-1 17 CVEs
oxide-qt vulnerabilities
A type confusion bug was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandb…
first Jul 23, 2014 -
UnscoredUSN-2292-1 1 CVE
liblwp-protocol-https-perl vulnerability
It was discovered that the LWP::Protocol::https perl module incorrectly disabled peer certificate verification completely when only hostname verification was requested to be disabled. If a remote attacker were able to perform a machine-in-the-middle attack, t…
first Jul 17, 2014 -
UnscoredUSN-2279-1 1 CVE
transmission vulnerability
Ben Hawkes discovered that Transmission incorrectly handled certain peer messages. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.
first Jul 16, 2014 -
UnscoredUSN-2258-1 1 CVE
gnupg, gnupg2 vulnerability
Jean-René Reinhard, Olivier Levillain and Florian Maury discovered that GnuPG incorrectly handled certain OpenPGP messages. If a user or automated system were tricked into processing a specially-crafted message, GnuPG could consume resources, resulting in a d…
first Jun 26, 2014 -
UnscoredUSN-2256-1 1 CVE
swift vulnerability
John Dickinson discovered that Swift did not properly quote the WWW-Authenticate header value. If a user were tricked into navigating to a malicious Swift URL, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, …
first Jun 25, 2014 -
UnscoredUSN-2255-1 3 CVEs
neutron vulnerabilities
Darragh O'Reilly discovered that the Ubuntu packaging for OpenStack Neutron did not properly set up its sudo configuration. If a different flaw was found in OpenStack Neutron, this vulnerability could be used to escalate privileges. (CVE-2013-6433) Stephen Ma…
first Jun 25, 2014