8,437 results · Feed
-
Medium max 6.2USN-7259-2 1 CVE
glibc vulnerability
USN-7259-1 fixed a vulnerability in GNU C Library. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: It was discovered that GNU C Library incorrectly handled memory when using the assert function. An attacker could…
first Feb 10, 2025 -
Medium max 6.1USN-7258-1 5 CVEs
ckeditor vulnerabilities
Kevin Backhouse discovered that CKEditor did not properly sanitize HTML content. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20…
first Feb 6, 2025 -
Critical max 9.0USN-7257-1 1 CVE
krb5 vulnerability
Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl discovered that Kerberos incorrectly authenticated certain responses. An attacker able to intercept communications between a RADIUS client and server could possibly us…
first Feb 5, 2025 -
Medium max 5.9USN-7249-1 1 CVE
libvpx vulnerability
Xiantong Hou discovered that libvpx would overflow when attempting to allocate memory for very large images. If an application using libvpx opened a specially crafted file, a remote attacker could possibly use this issue to cause the application to crash, res…
first Feb 3, 2025 -
High max 8.1USN-7248-1 1 CVE
libndp vulnerability
It was discovered that libndp incorrectly handled certain malformed IPv6 router advertisement packets. A local attacker could possibly use this issue to cause NetworkManager to crash, resulting in a denial of service, or the execution of arbitrary code.
first Feb 3, 2025 -
High max 8.0USN-7243-1 1 CVE
vlc vulnerability
It was discovered that VLC incorrectly handled memory when reading an MMS stream. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
first Jan 30, 2025 -
High max 7.5USN-7231-1 9 CVEs
tcpreplay vulnerabilities
It was discovered that Tcpreplay incorrectly handled memory when using the tcprewrite utility. A remote attacker could possibly use this issue to cause Tcpreplay to crash, resulting in a denial of service. (CVE-2023-27783) It was discovered that Tcpreplay inc…
first Jan 28, 2025 -
High max 7.5USN-7227-1 1 CVE
PCL vulnerability
It was discovered that PCL incorrectly handled certain malformed files. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly exploit this to cause a denial of service.
first Jan 23, 2025 -
Critical max 9.8USN-7225-1 9 CVEs
HTMLDOC vulnerabilities
It was discovered that HTMLDOC incorrectly handled memory in the image_set_mask, git_read_lzw, write_header and write_node functions, which could lead to a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute…
first Jan 22, 2025 -
Medium max 5.6USN-7223-1 2 CVEs
openjpeg2 vulnerabilities
Frank Zeng discovered that OpenJPEG incorrectly handled memory when using the decompression utility. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-56826, CVE-2024-56827)
first Jan 22, 2025 -
UnscoredUSN-7217-1 10 CVEs
libpodofo vulnerabilities
It was discovered that the PoDoFo library could dereference a NULL pointer when getting the number of pages in a PDF. If a user or application were tricked into opening a crafted PDF file, an attacker could possibly use this issue to cause a denial of service…
first Jan 20, 2025 -
Medium max 4.3USN-7213-1 1 CVE
poppler vulnerability
It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause denial of service or obtain sensitive information.
first Jan 16, 2025 -
UnscoredUSN-7211-1 1 CVE
audacity vulnerability
Mike Salvatore discovered that Audacity incorrectly handled default permissions of temporary files created by the application. An attacker could possibly use this issue to obtain sensitive information.
first Jan 16, 2025 -
High max 7.8USN-7209-1 1 CVE
gimp-dds vulnerabilities
Jacob Boerema discovered that the GIMP DDS Plugin incorrectly processed DDS files due to a memory issue. An attacker could exploit this through a specifically crafted DDS file to cause GIMP to crash, resulting in a denial of service, or possibly execute arbit…
first Jan 16, 2025 -
Critical max 9.8USN-7208-1 1 CVE
bcel vulnerability
Felix Wilhelm discovered that Apache Commons BCEL APIs incorrectly handled parameters due to a memory issue. An attacker supplying malicious input could exploit this to generate and execute arbitrary bytecode.
first Jan 16, 2025 -
UnscoredUSN-7206-2 0 CVEs
rsync regression
USN-7206-1 fixed vulnerabilities in rsync. The update introduced a regression in rsync. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync did …
first Jan 16, 2025 -
Critical max 9.8USN-7206-1 6 CVEs
Several security issues were fixed in rsync
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync did not properly handle checksum lengths. An attacker could use this issue to execute arbitrary code. (CVE-2024-12084) Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that …
first Jan 14, 2025 -
High max 7.0USN-7203-1 6 CVEs
pdns, pdns-recursor vulnerabilities
Wei Hao discovered that PowerDNS Authoritative Server incorrectly handled memory when accessing certain files. An attacker could possibly use this issue to achieve arbitrary code execution. (CVE-2018-1046) It was discovered that PowerDNS Authoritative Server …
first Jan 14, 2025 -
High max 7.8USN-7117-1 5 CVEs
Several security issues were fixed in needrestart and Module::ScanDeps
Qualys discovered that needrestart passed unsanitized data to a library (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-11003) Qualys discovered that the library l…
first Nov 19, 2024 -
Critical max 9.8USN-7114-1 1 CVE
glib2.0 vulnerability
It was discovered that Glib incorrectly handled certain trailing characters. An attacker could possibly use this issue to cause a crash or other undefined behavior.
first Nov 18, 2024 -
Medium max 6.5USN-7112-1 1 CVE
libgd2 vulnerability
It was discovered that the GD Graphics Library did not perform proper bounds checking while handling BMP and WebP files. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service (appl…
first Nov 15, 2024 -
High max 7.8
roundcube vulnerability
It was discovered that Roundcube incorrectly handled certain file-based attachment plugins. An attacker could exploit this to gain unauthorized access to arbitrary files on the host’s file system.
first Jan 13, 2025 -
Medium max 5.3USN-7197-1 1 CVE
golang-golang-x-net vulnerability
Guido Vranken discovered that Go Networking handled input to the Parse functions inefficiently. An attacker could possibly use this issue to cause denial of service. This update addresses the issue in the golang-golang-x-net and golang-golang-x-net-dev packag…
first Jan 9, 2025 -
Critical max 9.8USN-7190-1 1 CVE
tinyproxy vulnerability
It was discovered that Tinyproxy did not properly manage memory during the parsing of HTTP connection headers. An attacker could use this issue to cause a DoS or possibly execute arbitrary code.
first Jan 8, 2025 -
UnscoredUSN-7189-1 11 CVEs
HTMLDOC vulnerabilities
It was discovered that HTMLDOC incorrectly handled certain inputs, which could lead to an integer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-20308) It was discovered that HTMLDOC in…
first Jan 8, 2025 -
Medium max 6.2USN-7188-1 1 CVE
ffmpeg vulnerability
It was discovered that FFmpeg incorrectly handled certain input, which could lead to an integer overflow. An attacker could possibly use this issue to cause a denial of service by crashing the application.
first Jan 8, 2025 -
Critical max 9.8
phpunit vulnerability
It was discovered that PHPUnit incorrectly handled web requests if exposed to the internet. An attacker could possibly use this issue to achive remote code execution or obtain sensitive information.
first Dec 18, 2024 -
High max 7.8USN-7168-1 2 CVEs
editorconfig-core vulnerabilities
It was discovered that EditorConfig improperly managed memory when handling certain inputs, leading to overflows. An attacker could possibly use these issues to cause a denial of service, or execute arbitrary code.
first Dec 18, 2024 -
Critical max 10.0USN-7161-2 2 CVEs
Docker vulnerabilities
USN-7161-1 fixed CVE-2024-29018 in Ubuntu 24.04 LTS. This update fixes it for source package docker.io in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and source package docker.io-app for Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. USN-7161-1 fixed CVE-2024-41110 in Ubuntu…
first Feb 18, 2025 -
High max 7.5USN-7160-1 1 CVE
mpmath vulnerability
It was discovered Mpmath incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause Mpmath to consume resources, leading to a denial of service.
first Dec 15, 2024 -
Critical max 9.8USN-7157-3 4 CVEs
php7.0 vulnerabilities
USN-7157-1 fixed vulnerabilities in PHP versions 7.4, 8.1, and 8.3. This update provides the corresponding updates for PHP version 7.0. Original advisory details: It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted…
first Jan 29, 2025 -
Critical max 9.8USN-7153-1 1 CVE
php7.0, php7.2 vulnerability
It was discovered that PHP incorrectly handled long string inputs in two database drivers. An attacker could possibly use this issue to write files in locations they would not normally have access to. (CVE-2024-11236)
first Dec 12, 2024 -
High max 8.1USN-7151-1 2 CVEs
ofono vulnerabilities
It was discovered that oFono incorrectly handled decoding SMS messages leading to a stack overflow. A remote attacker could potentially use this issue to cause a denial of service. (CVE-2023-4232, CVE-2023-4235)
first Dec 11, 2024 -
High max 8.8USN-7149-1 5 CVEs
intel-microcode vulnerabilities
Avraham Shalev and Nagaraju N Kodalapura discovered that some Intel(R) Xeon(R) processors did not properly restrict access to the memory controller when using Intel(R) SGX. This may allow a local privileged attacker to further escalate their privileges. (CVE-…
first Dec 11, 2024 -
Critical max 9.8USN-7147-1 4 CVEs
shiro vulnerabilities
It was discovered that Apache Shiro incorrectly handled path traversal when used with other web frameworks or path rewriting. An attacker could possibly use this issue to obtain sensitive information or administrative privileges. This update provides the corr…
first Dec 10, 2024 -
Medium max 5.9USN-7146-1 3 CVEs
dogtag-pki vulnerabilities
Christina Fu discovered that Dogtag PKI accidentally enabled a mock authentication plugin by default. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates. This issue only a…
first Dec 10, 2024 -
Medium max 5.9USN-7145-1 1 CVE
expat vulnerability
It was discovered that Expat did not properly handle its internal state when attempting to resume an unstarted parser. An attacker could use this issue to cause a denial of service (application crash).
first Dec 10, 2024 -
High max 8.1USN-7141-1 3 CVEs
ofono vulnerabilities
It was discovered that oFono incorrectly handled decoding SMS messages leading to a stack overflow. A remote attacker could potentially use this issue to cause a denial of service. (CVE-2023-2794, CVE-2023-4233, CVE-2023-4234)
first Dec 9, 2024 -
UnscoredUSN-7140-1 1 CVE
tinyproxy vulnerability
It was discovered that Tinyproxy did not properly manage memory under certain circumstances. An attacker could possibly use this issue to leak left-over heap data if custom error page templates containing special non-standard variables are used.
first Dec 9, 2024 -
Critical max 9.8
shiro vulnerability
It was discovered that Apache Shiro used a static cipher within the "Remember Me" feature inside authentication by default. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information.
first Dec 5, 2024