Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Ubuntu_linux
(Canonical)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-09-15 | CVE-2020-14385 | A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability. | Ubuntu_linux, Debian_linux, Linux_kernel | 5.5 | ||
| 2020-09-16 | CVE-2020-14392 | An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability. | Ubuntu_linux, Debian_linux, Fedora, Leap, Database_interface | 5.5 | ||
| 2020-09-16 | CVE-2020-14382 | A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals =... | Ubuntu_linux, Cryptsetup, Fedora, Enterprise_linux | 7.8 | ||
| 2020-09-17 | CVE-2019-20919 | An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference. | Ubuntu_linux, Debian_linux, Fedora, Leap, Dbi | 4.7 | ||
| 2020-09-27 | CVE-2020-26116 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. | Ubuntu_linux, Debian_linux, Fedora, Hci_compute_node, Hci_storage_node, Solidfire, Leap, Zfs_storage_appliance_kit, Python | 7.2 | ||
| 2020-09-30 | CVE-2020-14378 | An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period. | Ubuntu_linux, Data_plane_development_kit, Leap | 3.3 | ||
| 2020-10-02 | CVE-2020-7069 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data. | Ubuntu_linux, Debian_linux, Fedora, Clustered_data_ontap, Leap, Communications_diameter_signaling_router, Php, Tenable\.sc | 6.5 | ||
| 2020-10-02 | CVE-2020-7070 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information. | Ubuntu_linux, Debian_linux, Fedora, Clustered_data_ontap, Leap, Php, Tenable\.sc | 5.3 | ||
| 2020-11-02 | CVE-2020-28039 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. | Ubuntu_linux, Debian_linux, Wordpress | 9.1 | ||
| 2020-11-02 | CVE-2020-28040 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | Ubuntu_linux, Debian_linux, Wordpress | 4.3 |