8,435 results · Feed
-
Medium max 6.3USN-6944-2 1 CVE
curl vulnerability
USN-6944-1 fixed CVE-2024-7264 for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. This update provides the corresponding fix for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: Dov Murik discovered that curl inc…
first Aug 20, 2024 -
Critical max 9.8
libcommons-collections3-java vulnerability
It was discovered that Apache Commons Collections allowed serialization support for unsafe classes by default. A remote attacker could possibly use this issue to execute arbitrary code.
first Jul 31, 2024 -
High max 7.0USN-6908-1 3 CVEs
tomcat vulnerabilities
It was discovered that the Tomcat SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221) It was discovered that Tomcat incorrectly handled certain uncommon Persis…
first Jul 23, 2024 -
High max 7.5USN-6905-1 2 CVEs
ruby-rack vulnerabilities
It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27539) It was discovered that Rack incorrectly handled M…
first Jul 23, 2024 -
UnscoredUSN-6881-1 1 CVE
exim4 vulnerability
It was discovered that Exim did not enforce STARTTLS sync point on client side. An attacker could possibly use this issue to perform response injection during MTA SMTP sending.
first Jul 8, 2024 -
High max 8.4USN-6855-1 1 CVE
libcdio vulnerability
Mansour Gashasbi discovered that libcdio incorrectly handled certain memory operations when parsing an ISO file, leading to a buffer overflow vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code.
first Jun 28, 2024 -
Critical max 9.8USN-6850-1 1 CVE
openvpn vulnerability
It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use this issue to bypass authentication using incomplete credentials.
first Jun 26, 2024 -
Critical max 9.8
salt vulnerabilities
It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)
first Jun 25, 2024 -
Medium max 5.8USN-6837-2 3 CVEs
ruby-rack vulnerabilities
It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-2…
first Aug 19, 2024 -
Medium max 5.5USN-6827-1 1 CVE
tiff vulnerability
It was discovered that LibTIFF incorrectly handled memory when performing certain cropping operations, leading to a heap buffer overflow. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.
first Jun 11, 2024 -
Medium max 5.4USN-6787-1 1 CVE
jinja2 vulnerability
It was discovered that Jinja2 incorrectly handled certain HTML attributes that were accepted by the xmlattr filter. An attacker could use this issue to inject arbitrary HTML attribute keys and values to potentially execute a cross-site scripting (XSS) attack.
first May 28, 2024 -
High max 7.8
libspreadsheet-parseexcel-perl vulnerability
Le Dinh Hai discovered that Spreadsheet::ParseExcel was passing unvalidated input from a file into a string-type "eval". An attacker could craft a malicious file to achieve arbitrary code execution.
first May 21, 2024 -
High max 7.8USN-6762-1 5 CVEs
eglibc, glibc vulnerabilities
It was discovered that GNU C Library incorrectly handled netgroup requests. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9984) It was discovered that GNU C Library m…
first May 2, 2024 -
Medium max 5.5USN-6760-1 1 CVE
gerbv vulnerability
George-Andrei Iosif and David Fernandez Gonzalez discovered that Gerbv did not properly initialize a data structure when parsing certain nested RS-274X format files. If a user were tricked into opening a specially crafted file, an attacker could possibly use …
first Apr 30, 2024 -
High max 8.6USN-6756-1 1 CVE
less vulnerability
It was discovered that less mishandled newline characters in file names. If a user or automated system were tricked into opening specially crafted files, an attacker could possibly use this issue to execute arbitrary commands on the host.
first Apr 29, 2024 -
Low max 3.7USN-6751-1 2 CVEs
zabbix vulnerabilities
It was discovered that Zabbix incorrectly handled input data in the discovery and graphs pages. A remote authenticated attacker could possibly use this issue to perform reflected cross-site scripting (XSS) attacks. (CVE-2022-35229, CVE-2022-35230)
first Apr 25, 2024 -
Medium max 6.7USN-6744-1 1 CVE
pillow vulnerability
Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which could lead to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ICC file, an attacker could p…
first Apr 22, 2024 -
Critical max 9.8USN-6736-1 4 CVEs
klibc vulnerabilities
It was discovered that zlib, vendored in klibc, incorrectly handled pointer arithmetic. An attacker could use this issue to cause klibc to crash or to possibly execute arbitrary code. (CVE-2016-9840, CVE-2016-9841) Danilo Ramos discovered that zlib, vendored …
first Apr 16, 2024 -
High max 7.5USN-6735-1 3 CVEs
nodejs vulnerabilities
It was discovered that Node.js incorrectly handled the use of invalid public keys while creating an x509 certificate. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to…
first Apr 16, 2024 -
Critical max 9.8USN-6730-1 1 CVE
maven-shared-utils vulnerability
It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code.
first Apr 11, 2024 -
High max 7.5USN-6723-1 2 CVEs
bind9 vulnerabilities
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Bind icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023-…
first Apr 9, 2024 -
UnscoredUSN-6721-2 0 CVEs
xorg-server, xwayland regression
USN-6721-1 fixed vulnerabilities in X.Org X Server. That fix was incomplete resulting in a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that X.Org X Server incorrectly handled cert…
first Apr 9, 2024 -
High max 7.8USN-6721-1 4 CVEs
xorg-server, xwayland vulnerabilities
It was discovered that X.Org X Server incorrectly handled certain data. An attacker could possibly use this issue to expose sensitive information. (CVE-2024-31080, CVE-2024-31081, CVE-2024-31082) It was discovered that X.Org X Server incorrectly handled certa…
first Apr 4, 2024 -
High max 7.8USN-6708-1 1 CVE
graphviz vulnerability
It was discovered that Graphviz incorrectly handled certain config6a files. An attacker could possibly use this issue to cause a denial of service.
first Mar 21, 2024 -
Critical max 9.8USN-6722-1 1 CVE
python-django vulnerability
Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts.
first Apr 8, 2024 -
High max 7.8USN-6698-1 1 CVE
vim vulnerability
Zhen Zhou discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service
first Mar 18, 2024 -
UnscoredUSN-6684-1 1 CVE
ncurses vulnerability
It was discovered that ncurses incorrectly handled certain function return values, possibly leading to segmentation fault. A local attacker could possibly use this to cause a denial of service (system crash).
first Mar 7, 2024 -
High max 7.5USN-6658-2 1 CVE
libxml2 vulnerability
USN-6658-1 fixed a vulnerability in libxml2. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: It was discovered that libxml2 incorrectly handled certain XML documents. A re…
first Mar 11, 2024 -
Medium max 5.5USN-6645-1 1 CVE
linux vulnerability
It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform reference counting in some error conditions. A local attacker could possibly use this to cause a denial of service (memory exhaustion).
first Feb 20, 2024 -
Medium max 4.7USN-6640-1 1 CVE
shadow vulnerability
It was discovered that shadow was not properly sanitizing memory when running the password utility. An attacker could possibly use this issue to retrieve a password from memory, exposing sensitive information.
first Feb 15, 2024 -
Medium max 6.2USN-6621-1 1 CVE
imagemagick vulnerability
It was discovered that ImageMagick incorrectly handled certain values when processing BMP files. An attacker could exploit this to cause a denial of service.
first Feb 1, 2024 -
High max 8.6USN-6619-1 1 CVE
runc vulnerability
Rory McNamara discovered that runC did not properly manage internal file descriptor while managing containers. An attacker could possibly use this issue to obtain sensitive information or bypass container restrictions.
first Jan 31, 2024 -
Medium max 6.5USN-6613-1 1 CVE
ceph vulnerability
Lucas Henry discovered that Ceph incorrectly handled specially crafted POST requests. An uprivileged user could use this to bypass Ceph's authorization checks and upload a file to any bucket.
first Jan 29, 2024 -
High max 7.8USN-6557-1 14 CVEs
vim vulnerabilities
It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1725) It was discovere…
first Dec 14, 2023 -
Medium max 5.4USN-6599-1 2 CVEs
jinja2 vulnerabilities
Yeting Li discovered that Jinja incorrectly handled certain regex. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-28493) It was discovered th…
first Jan 25, 2024 -
UnscoredUSN-6591-2 1 CVE
postfix update
USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of regression has been made available since the last update. This update updates the fix and aligns with the latest configuration guidelines regarding this vulnerability. We apologize for the i…
first Jan 31, 2024 -
UnscoredUSN-6591-1 1 CVE
postfix vulnerability
Timo Longin discovered that Postfix incorrectly handled certain email line endings. A remote attacker could possibly use this issue to bypass an email authentication mechanism, allowing domain spoofing and potential spamming. Please note that certain configur…
first Jan 22, 2024 -
High max 8.2USN-6590-1 2 CVEs
xerces-c vulnerabilities
It was discovered that Xerces-C++ was not properly handling memory management operations when parsing XML data containing external DTDs, which could trigger a use-after-free error. If a user or automated system were tricked into processing a specially crafted…
first Jan 18, 2024 -
Medium max 5.5USN-6588-2 1 CVE
pam vulnerability
USN-6588-1 fixed a vulnerability in PAM. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: Matthias Gerstner discovered that the PAM pam_namespace module incorrectly handled…
first Mar 26, 2024 -
Critical max 9.8USN-6587-5 6 CVEs
xorg-server vulnerabilities
USN-6587-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the RRChangeOutputP…
first Mar 13, 2024