Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Varnish vulnerability (USN-7372-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7372-1 advisory. Martin van Kervel Smedshammer discovered that Varnish did not properly sanitize certain HTTP headers. A remote attacker could possibly use...

USN-7371-1: FreeRDP vulnerabilities

Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a remote attacker could possibly use this issue to cause FreeRDP to crash, resulting in a denial of service. CVE-2024-32458 Evgeny Legerov discovered...

[SECURITY] [DLA 4091-1] nginx security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4091-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura March 25, 2025 https://wiki.debian.org/LTS -...

USN-7370-1: SmartDNS vulnerabilities

It was discovered that SmartDNS did not correctly align certain objects in memory, leading to undefined behaviour. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. CVE-2024-24198, CVE-2024-24199 It was...

Ubuntu 24.04 LTS : FreeRDP vulnerabilities (USN-7371-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7371-1 advisory. Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a...

[SECURITY] [DLA 4090-1] ruby-rack security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4090-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk March 24, 2025 https://wiki.debian.org/LTS -...

USN-7369-1: elfutils vulnerabilities

It was discovered that readelf from elfutils could be made to read out of bounds. If a user or automated system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Umbraco Umbraco_Cms

Proof of concept for CVE-2025-24011 based on https://github.com/...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Alpine vulnerabilities (USN-7360-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7360-1 advisory. It was discovered that Alpine did not use a secure connection under certain circumstances. A remote attacker could possibly use...

[SECURITY] [DLA 4086-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4086-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb March 19, 2025 https://wiki.debian.org/LTS -...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : PlantUML vulnerability (USN-7353-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7353-1 advisory. Tobias S. Fink discovered that PlantUML was susceptible to cross-site scripting attacks XSS in instances...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : djoser vulnerability (USN-7354-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7354-1 advisory. Diego Cebrin discovered that djoser did not properly handle user authentication. An attacker with valid credentials could possibly...

USN-7352-1: FreeType vulnerability

It was discovered that FreeType incorrectly handled certain memory operations when parsing font subglyph structures. A remote attacker could use this issue to cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-7343-2: Jinja2 regression

USN-7343-1 fixed vulnerabilities in Jinja2. The update introduced a regression when attempting to import Jinja2 on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Rafal Krupinski discovered that Jinja2 did not...

USN-7349-1: RAR vulnerabilities

It was discovered that RAR incorrectly handled certain paths. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to write arbitrary files outside of the targeted directory. CVE-2022-30333 It was discovered th...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Jinja2 vulnerabilities (USN-7343-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7343-1 advisory. Rafal Krupinski discovered that Jinja2 did not properly restrict the execution of cod...

USN-7343-1: Jinja2 vulnerabilities

Rafal Krupinski discovered that Jinja2 did not properly restrict the execution of code in situations where templates are used maliciously. An attacker with control over a template's filename and content could potentially use this issue to enable the execution of arbitrary code. This issue only...

USN-7341-1: FreeRDP vulnerabilities

Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2024-3203...

[SECURITY] [DLA 4083-1] squid security update

Debian LTS Advisory DLA-4083-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof March 11, 2025 https://wiki.debian.org/LTS Package : squid Version : 4.13-10+deb11u4 CVE ID : CVE-2024-25111 CVE-2024-37894 CVE-2024-45802 Debian Bug : Several security vulnerabiliti...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenVPN vulnerabilities (USN-7340-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7340-1 advisory. It was discovered that OpenVPN did not perform proper input validation when generating a TLS key under certain configuration, whi...