Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Ubuntu_linux
(Canonical)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2015-08-31 | CVE-2015-5364 | The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood. | Ubuntu_linux, Debian_linux, Linux_kernel, Enterprise_linux_server_aus | N/A | ||
| 2020-07-02 | CVE-2020-8161 | A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure. | Ubuntu_linux, Debian_linux, Rack | 8.6 | ||
| 2020-01-08 | CVE-2019-11757 | When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. | Ubuntu_linux, Firefox, Firefox_esr, Thunderbird | 8.8 | ||
| 2020-01-08 | CVE-2019-11759 | An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. | Ubuntu_linux, Firefox, Firefox_esr, Thunderbird | 8.8 | ||
| 2020-01-08 | CVE-2019-11760 | A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. | Ubuntu_linux, Firefox, Firefox_esr, Thunderbird | 8.8 | ||
| 2020-01-08 | CVE-2019-11761 | By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. | Ubuntu_linux, Firefox, Firefox_esr, Thunderbird | 5.4 | ||
| 2020-01-08 | CVE-2019-11762 | If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. | Ubuntu_linux, Firefox, Firefox_esr, Thunderbird | 6.1 | ||
| 2020-01-13 | CVE-2020-5390 | PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed. | Ubuntu_linux, Debian_linux, Pysaml2 | 7.5 | ||
| 2020-01-17 | CVE-2019-17361 | In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. | Ubuntu_linux, Debian_linux, Leap, Salt | 9.8 | ||
| 2020-09-23 | CVE-2020-25739 | An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson. | Ubuntu_linux, Debian_linux, Gon | 6.1 |