Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Ubuntu_linux
(Canonical)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2016-04-12 | CVE-2016-3157 | The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access. | Ubuntu_linux, Xen | 7.8 | ||
| 2016-03-14 | CVE-2016-2856 | pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations,... | Ubuntu_linux, Debian_linux | 8.4 | ||
| 2016-06-13 | CVE-2016-2833 | Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted applet. | Ubuntu_linux, Firefox, Leap, Opensuse | 6.1 | ||
| 2016-06-13 | CVE-2016-2832 | Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes. | Ubuntu_linux, Firefox, Leap, Opensuse | 4.3 | ||
| 2016-06-13 | CVE-2016-2829 | Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the microphone permission or the geolocation permission. | Ubuntu_linux, Firefox, Leap, Opensuse | 6.5 | ||
| 2016-06-13 | CVE-2016-2825 | Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL. | Ubuntu_linux, Firefox, Leap, Opensuse | 6.5 | ||
| 2017-01-06 | CVE-2016-2380 | An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. | Ubuntu_linux, Debian_linux, Pidgin | 3.1 | ||
| 2017-01-06 | CVE-2016-2378 | A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability. | Ubuntu_linux, Debian_linux, Pidgin | 8.1 | ||
| 2017-01-06 | CVE-2016-2377 | A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability. | Ubuntu_linux, Debian_linux, Pidgin | 8.1 | ||
| 2017-01-06 | CVE-2016-2376 | A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow. | Ubuntu_linux, Debian_linux, Pidgin | 8.1 |