Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~
There are 1,544 matching records.
Displaying matches 41 through 60.
Vuln ID Summary CVSS Severity

hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.

Published: July 28, 2020; 12:15:12 PM -0400
V3.1: 5.3 MEDIUM
V2.0: 4.4 MEDIUM

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.

Published: July 22, 2020; 1:15:13 PM -0400
V3.1: 6.5 MEDIUM
V2.0: 4.3 MEDIUM

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

Published: July 17, 2020; 12:15:11 PM -0400
V3.1: 5.9 MEDIUM
V2.0: 4.3 MEDIUM

An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.

Published: July 15, 2020; 6:15:13 PM -0400
V3.1: 6.7 MEDIUM
V2.0: 6.9 MEDIUM

In Lib/ in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by, because _proc_pax lacks header validation.

Published: July 13, 2020; 9:15:10 AM -0400
V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.

Published: June 30, 2020; 7:15:10 AM -0400
V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/ private archive login page.

Published: June 24, 2020; 8:15:10 AM -0400
V3.1: 4.3 MEDIUM
V2.0: 2.6 LOW

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Published: June 15, 2020; 10:15:11 AM -0400
V3.1: 5.5 MEDIUM
V2.0: 2.1 LOW

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.

Published: June 12, 2020; 10:15:11 AM -0400
V3.1: 4.4 MEDIUM
V2.0: 3.6 LOW

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

Published: June 08, 2020; 1:15:09 PM -0400
V3.1: 5.5 MEDIUM
V2.0: 4.9 MEDIUM

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

Published: June 03, 2020; 10:15:12 AM -0400
V3.1: 5.9 MEDIUM
V2.0: 4.3 MEDIUM

go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.

Published: June 02, 2020; 8:15:10 PM -0400
V3.1: 5.5 MEDIUM
V2.0: 4.9 MEDIUM

hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

Published: June 02, 2020; 10:15:10 AM -0400
V3.1: 6.7 MEDIUM
V2.0: 4.6 MEDIUM

In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.

Published: May 28, 2020; 8:15:11 AM -0400
V3.1: 6.5 MEDIUM
V2.0: 6.4 MEDIUM

sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.

Published: May 27, 2020; 11:15:12 AM -0400
V3.1: 5.5 MEDIUM
V2.0: 2.1 LOW

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

Published: May 26, 2020; 2:15:11 PM -0400
V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.

Published: May 22, 2020; 2:15:11 PM -0400
V3.1: 8.3 HIGH
V2.0: 6.5 MEDIUM

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.

Published: May 22, 2020; 2:15:11 PM -0400
V3.1: 5.5 MEDIUM
V2.0: 2.1 LOW

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.

Published: May 22, 2020; 2:15:11 PM -0400
V3.1: 7.1 HIGH
V2.0: 5.5 MEDIUM

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Published: May 20, 2020; 3:15:09 PM -0400
V3.1: 7.0 HIGH
V2.0: 4.4 MEDIUM