Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Ubuntu_linux
(Canonical)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2017-04-06 | CVE-2016-8735 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types. | Tomcat, Ubuntu_linux, Debian_linux, 7\-Mode_transition_tool, Oncommand_insight, Oncommand_shift, Snap_creator_framework, Agile_engineering_data_management, Agile_plm, Communications_application_session_controller, Communications_instant_messaging_server, Communications_interactive_session_recorder, Hospitality_guest_access, Micros_relate_crm_software, Micros_retail_xbri_loss_prevention, Mysql_enterprise_monitor, Retail_convenience_and_fuel_pos_software, Transportation_management, Jboss_enterprise_web_server | 9.8 | ||
| 2020-03-06 | CVE-2019-20503 | usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. | Ubuntu_linux, Debian_linux, Usrsctp | 6.5 | ||
| 2022-02-16 | CVE-2021-3560 | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. | Ubuntu_linux, Debian_linux, Polkit, Openshift_container_platform, Virtualization, Virtualization_host | 7.8 | ||
| 2024-01-08 | CVE-2022-2586 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. | Ubuntu_linux, Linux_kernel | 7.8 | ||
| 2007-03-24 | CVE-2007-1667 | Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in X.Org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or obtain sensitive information via crafted images with large or negative values that trigger a buffer overflow. | Ubuntu_linux, Debian_linux, Libx11 | N/A | ||
| 2023-06-16 | CVE-2023-35788 | An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. | Ubuntu_linux, Debian_linux, Linux_kernel, H300s_firmware, H410c_firmware, H410s_firmware, H500s_firmware, H700s_firmware | 7.8 | ||
| 2019-12-10 | CVE-2019-14861 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that... | Ubuntu_linux, Debian_linux, Fedora, Leap, Samba | 5.3 | ||
| 2019-02-15 | CVE-2019-8354 | An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow. | Ubuntu_linux, Debian_linux, Sound_exchange | 5.0 | ||
| 2024-06-04 | CVE-2022-28652 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack | Apport, Ubuntu_linux | 5.5 | ||
| 2024-06-04 | CVE-2022-28654 | is_closing_session() allows users to fill up apport.log | Apport, Ubuntu_linux | 5.5 |