Lucene search

K
CanonicalUbuntu Linux18.10

425 matches found

CVE
CVE
added 2019/05/16 7:29 p.m.258 views

CVE-2019-3839

It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript ...

7.8CVSS7.7AI score0.62738EPSS
CVE
CVE
added 2018/12/12 5:29 p.m.257 views

CVE-2018-20103

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

7.5CVSS7.2AI score0.00089EPSS
CVE
CVE
added 2019/03/21 4:1 p.m.257 views

CVE-2019-6778

In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

7.8CVSS6.5AI score0.00073EPSS
CVE
CVE
added 2019/05/29 5:29 p.m.254 views

CVE-2019-12447

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used.

7.3CVSS7AI score0.00515EPSS
CVE
CVE
added 2019/05/29 5:29 p.m.254 views

CVE-2019-12449

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.

5.7CVSS6AI score0.00515EPSS
CVE
CVE
added 2019/01/29 12:29 a.m.254 views

CVE-2019-7150

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-o...

5.5CVSS6.9AI score0.00136EPSS
CVE
CVE
added 2019/01/03 4:29 p.m.253 views

CVE-2018-16882

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' ...

8.8CVSS8.1AI score0.00111EPSS
CVE
CVE
added 2019/04/23 7:32 p.m.253 views

CVE-2019-2632

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to comprom...

7.5CVSS5.4AI score0.00459EPSS
CVE
CVE
added 2018/12/28 4:29 p.m.252 views

CVE-2018-1000888

PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with $v_header['filename'] as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger...

8.8CVSS8.8AI score0.25032EPSS
CVE
CVE
added 2018/10/17 1:31 a.m.252 views

CVE-2018-3247

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Merge). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

5.5CVSS5.5AI score0.00418EPSS
CVE
CVE
added 2018/10/17 1:31 a.m.252 views

CVE-2018-3276

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocol...

4.9CVSS5AI score0.00079EPSS
CVE
CVE
added 2019/04/24 5:29 a.m.249 views

CVE-2019-11498

WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.

6.5CVSS6.2AI score0.01699EPSS
CVE
CVE
added 2018/11/21 12:29 a.m.248 views

CVE-2018-19407

The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.

5.5CVSS6.4AI score0.00093EPSS
CVE
CVE
added 2018/10/25 8:29 p.m.247 views

CVE-2018-14665

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root p...

7.2CVSS7AI score0.06474EPSS
CVE
CVE
added 2019/02/06 8:29 p.m.247 views

CVE-2019-3823

libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call ...

7.5CVSS8.5AI score0.01536EPSS
CVE
CVE
added 2019/02/05 9:29 p.m.245 views

CVE-2018-18500

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, ...

9.8CVSS7.1AI score0.32159EPSS
CVE
CVE
added 2019/02/22 3:29 p.m.245 views

CVE-2019-9003

In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.

7.8CVSS7.3AI score0.07134EPSS
CVE
CVE
added 2018/12/03 5:29 p.m.244 views

CVE-2018-19824

In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c.

7.8CVSS6.9AI score0.00071EPSS
CVE
CVE
added 2018/12/26 3:29 a.m.239 views

CVE-2018-20467

In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

6.5CVSS7.1AI score0.00157EPSS
CVE
CVE
added 2018/12/07 9:29 p.m.237 views

CVE-2018-18313

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

9.1CVSS8.9AI score0.03978EPSS
CVE
CVE
added 2019/01/11 5:29 a.m.237 views

CVE-2019-6128

The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.

8.8CVSS8.4AI score0.02457EPSS
CVE
CVE
added 2019/03/07 11:29 p.m.237 views

CVE-2019-7175

In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.

7.5CVSS7.8AI score0.00181EPSS
CVE
CVE
added 2019/02/05 12:29 a.m.237 views

CVE-2019-7397

In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.

7.5CVSS7.4AI score0.00203EPSS
CVE
CVE
added 2019/04/23 7:32 p.m.236 views

CVE-2019-2566

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Audit Plug-in). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromis...

4.9CVSS4.6AI score0.0026EPSS
CVE
CVE
added 2019/04/22 11:29 a.m.235 views

CVE-2019-11235

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

9.8CVSS8.1AI score0.06662EPSS
CVE
CVE
added 2019/02/06 8:29 p.m.234 views

CVE-2018-16890

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that ...

7.5CVSS8.6AI score0.01104EPSS
CVE
CVE
added 2019/02/05 9:29 p.m.234 views

CVE-2018-18501

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thu...

9.8CVSS8AI score0.03064EPSS
CVE
CVE
added 2020/06/17 4:15 p.m.234 views

CVE-2019-20839

libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.

7.5CVSS7.6AI score0.03534EPSS
CVE
CVE
added 2019/01/23 7:29 p.m.234 views

CVE-2019-6706

Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.

7.5CVSS7.3AI score0.01247EPSS
CVE
CVE
added 2019/07/01 2:15 p.m.233 views

CVE-2019-12781

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest....

5.3CVSS5.6AI score0.02419EPSS
CVE
CVE
added 2019/04/30 7:29 p.m.232 views

CVE-2019-10131

An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.

7.1CVSS7.7AI score0.00074EPSS
CVE
CVE
added 2018/08/29 3:29 a.m.231 views

CVE-2018-16062

dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.

5.5CVSS6.7AI score0.0009EPSS
CVE
CVE
added 2019/04/09 4:29 a.m.230 views

CVE-2019-10895

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.

7.5CVSS7.2AI score0.08637EPSS
CVE
CVE
added 2019/10/29 7:15 p.m.229 views

CVE-2019-15681

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. Thi...

7.5CVSS8.3AI score0.03937EPSS
CVE
CVE
added 2019/02/01 10:29 p.m.228 views

CVE-2019-7308

kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.

5.6CVSS6AI score0.00047EPSS
CVE
CVE
added 2019/02/28 6:29 p.m.227 views

CVE-2018-18493

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < ...

9.8CVSS7.6AI score0.09156EPSS
CVE
CVE
added 2018/10/19 5:29 p.m.227 views

CVE-2018-18520

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a ...

6.5CVSS6.7AI score0.00801EPSS
CVE
CVE
added 2019/02/28 6:29 p.m.226 views

CVE-2018-18492

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

9.8CVSS7.5AI score0.27057EPSS
CVE
CVE
added 2019/02/05 12:29 a.m.226 views

CVE-2019-7398

In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.

7.5CVSS7.7AI score0.00181EPSS
CVE
CVE
added 2018/10/15 2:29 a.m.225 views

CVE-2018-18310

An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.

5.5CVSS6.2AI score0.00129EPSS
CVE
CVE
added 2019/01/02 7:29 a.m.225 views

CVE-2019-3500

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.

7.8CVSS7.1AI score0.00117EPSS
CVE
CVE
added 2019/06/30 11:15 p.m.224 views

CVE-2019-13114

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.

6.5CVSS6.1AI score0.00315EPSS
CVE
CVE
added 2019/02/04 6:29 p.m.223 views

CVE-2019-3813

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.

7.5CVSS7.4AI score0.00272EPSS
CVE
CVE
added 2018/12/12 5:29 p.m.222 views

CVE-2018-20102

An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessin...

7.5CVSS7.3AI score0.00033EPSS
CVE
CVE
added 2019/04/09 4:29 a.m.222 views

CVE-2019-10901

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly.

7.5CVSS7.2AI score0.10053EPSS
CVE
CVE
added 2018/09/03 7:29 p.m.220 views

CVE-2018-16402

libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.

9.8CVSS9.6AI score0.01061EPSS
CVE
CVE
added 2019/02/26 11:29 p.m.220 views

CVE-2019-9200

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other ...

8.8CVSS7.2AI score0.03559EPSS
CVE
CVE
added 2018/10/19 5:29 p.m.219 views

CVE-2018-18521

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.

5.5CVSS7.2AI score0.0014EPSS
CVE
CVE
added 2019/04/09 4:29 a.m.218 views

CVE-2019-10894

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called.

7.5CVSS7.2AI score0.08788EPSS
CVE
CVE
added 2019/04/09 4:29 a.m.218 views

CVE-2019-10899

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.

7.5CVSS7.3AI score0.08788EPSS
Total number of security vulnerabilities425