Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Ubuntu_linux
(Canonical)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-05-28 | CVE-2020-13645 | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host. | Fabric_operating_system, Ubuntu_linux, Fedora, Balsa, Glib\-Networking, Cloud_backup | 6.5 | ||
| 2020-06-01 | CVE-2020-12867 | A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075. | Ubuntu_linux, Debian_linux, Fedora, Leap, Sane_backends | 5.5 | ||
| 2020-06-01 | CVE-2020-13757 | Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation). | Ubuntu_linux, Fedora, Python\-Rsa | 7.5 | ||
| 2020-06-03 | CVE-2020-13254 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. | Ubuntu_linux, Debian_linux, Django, Fedora, Sra_plugin, Steelstore_cloud_integrated_storage, Zfs_storage_appliance_kit | 5.9 | ||
| 2020-06-03 | CVE-2020-13596 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. | Ubuntu_linux, Debian_linux, Django, Fedora, Sra_plugin, Steelstore_cloud_integrated_storage, Zfs_storage_appliance_kit | 6.1 | ||
| 2020-06-04 | CVE-2020-13777 | GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. | Ubuntu_linux, Debian_linux, Fedora, Gnutls | 7.4 | ||
| 2020-06-04 | CVE-2020-13765 | rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. | Ubuntu_linux, Debian_linux, Qemu | 5.6 | ||
| 2020-06-07 | CVE-2020-13904 | FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c. | Ubuntu_linux, Debian_linux, Ffmpeg | 5.5 | ||
| 2020-06-08 | CVE-2020-13625 | PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message. | Ubuntu_linux, Debian_linux, Fedora, Phpmailer | 7.5 | ||
| 2020-06-08 | CVE-2020-13696 | An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to test for the existence of arbitrary files and to trigger an open on arbitrary files with mode O_RDWR. To achieve this, relative path components need to be added to the device path, as demonstrated... | Ubuntu_linux, Debian_linux, Fedora, Xawtv, Backports_sle, Leap | 4.4 |