Canonical
Page 3 of 28 — Canonical CVEs from a corpus of 2720, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3640 | High | 7.0 | 2022-03-03 | A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way trigge… |
CVE-2022-0492 | High | 7.8 | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, a… |
CVE-2021-4115 | Medium | 5.5 | 2022-02-21 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from thi… |
CVE-2021-44142 | High | 8.8 | 2022-02-21 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a N… |
CVE-2022-0543 | Critical | 10.0 | 2022-02-18 | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could resul… |
CVE-2021-4093 | High | 8.8 | 2022-02-18 | A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of… |
CVE-2020-25722 | High | 8.8 | 2022-02-18 | Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total dom… |
CVE-2020-25719 | High | 7.2 | 2022-02-18 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become conf… |
CVE-2020-25717 | High | 8.1 | 2022-02-18 | A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. |
CVE-2016-2124 | Medium | 5.9 | 2022-02-18 | A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even i… |
CVE-2021-4120 | High | 8.2 | 2022-02-17 | snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor… |
CVE-2021-44731 | High | 7.8 | 2022-02-17 | A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain… |
CVE-2021-44730 | High | 7.8 | 2022-02-17 | snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap… |
CVE-2021-3155 | Low | 3.8 | 2022-02-17 | snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to re… |
CVE-2021-3560 | High | 7.8 | 2022-02-16 | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user… |
CVE-2021-45079 | Critical | 9.1 | 2022-01-31 | In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP… |
CVE-2021-4034 | High | 7.8 | 2022-01-28 | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users t… |
CVE-2022-23220 | High | 7.8 | 2022-01-21 | USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_an… |
CVE-2022-0319 | Medium | 5.5 | 2022-01-21 | Out-of-bounds Read in vim/vim prior to 8.2. |
CVE-2021-45417 | High | 7.8 | 2022-01-20 | AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-ba… |
CVE-2022-20698 | High | 7.5 | 2022-01-14 | A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unaut… |
CVE-2021-44420 | High | 7.3 | 2021-12-08 | In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based… |
CVE-2021-3939 | High | 7.8 | 2021-11-17 | Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static… |
CVE-2021-3747 | High | 8.8 | 2021-10-01 | The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner. |
CVE-2021-3710 | Medium | 6.5 | 2021-10-01 | An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2… |
CVE-2021-3709 | Medium | 6.5 | 2021-10-01 | Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issu… |
CVE-2021-3626 | High | 8.8 | 2021-10-01 | The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating sys… |
CVE-2021-32557 | Medium | 5.2 | 2021-06-12 | It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. |
CVE-2021-32556 | Low | 3.8 | 2021-06-12 | It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would… |
CVE-2021-32555 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package a… |
CVE-2021-32554 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hook… |
CVE-2021-32553 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package appor… |
CVE-2021-32552 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package appor… |
CVE-2021-32551 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package appor… |
CVE-2021-32550 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package appor… |
CVE-2021-32549 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package appor… |
CVE-2021-32548 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport… |
CVE-2021-32547 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package appo… |
CVE-2021-25684 | High | 8.8 | 2021-06-11 | It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. |
CVE-2021-25683 | High | 8.8 | 2021-06-11 | It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel. |
CVE-2021-25682 | High | 8.8 | 2021-06-11 | It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel. |
CVE-2021-3491 | High | 7.8 | 2021-06-04 | The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being u… |
CVE-2021-3490 | High | 7.8 | 2021-06-04 | The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of b… |
CVE-2021-3489 | High | 7.8 | 2021-06-04 | The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attack… |
CVE-2020-15078 | High | 7.5 | 2021-04-26 | OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authe… |
CVE-2021-3493 | High | 8.8 | 2021-04-17 | The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an unde… |
CVE-2021-3492 | High | 8.8 | 2021-04-17 | Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. Thes… |
CVE-2013-1055 | Medium | 4.3 | 2021-04-07 | The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash… |
CVE-2013-1054 | Medium | 4.3 | 2021-04-07 | The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning th… |
CVE-2021-3444 | High | 7.8 | 2021-03-23 | The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker… |
CVE-2020-27171 | Medium | 6.0 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-… |
CVE-2020-27170 | Medium | 4.7 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading… |
CVE-2021-27364 | High | 7.1 | 2021-03-07 | An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to… |
CVE-2020-16120 | Medium | 5.1 | 2021-02-10 | Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for examp… |
CVE-2020-16119 | Medium | 6.3 | 2021-01-14 | Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a li… |
CVE-2013-1053 | Medium | 5.5 | 2021-01-13 | In crypt.c of remote-login-service, the cryptographic algorithm used to cache usernames and passwords is insecure. An attacker could use this vulnerability to… |
CVE-2020-29385 | Medium | 5.5 | 2020-12-26 | GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, se… |
CVE-2020-27351 | Low | 2.0 | 2020-12-10 | Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affec… |
CVE-2020-27350 | Medium | 5.7 | 2020-12-10 | APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/… |
CVE-2020-27349 | Medium | 5.5 | 2020-12-09 | Aptdaemon performed policykit checks after interacting with potentially untrusted files with elevated privileges. This affected versions prior to 1.1.1+bzr982-… |
CVE-2020-16128 | Low | 3.8 | 2020-12-09 | The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affect… |
CVE-2020-27348 | Medium | 6.8 | 2020-12-04 | In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution withi… |
CVE-2020-16123 | Medium | 4.4 | 2020-12-04 | An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming f… |
CVE-2012-0955 | Medium | 6.8 | 2020-12-02 | software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properti… |
CVE-2020-29372 | Medium | 4.7 | 2020-11-28 | An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP… |
CVE-2020-0569 | Medium | 5.7 | 2020-11-23 | Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2020-15710 | Medium | 5.3 | 2020-11-19 | Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice… |
CVE-2020-16122 | High | 8.2 | 2020-11-07 | PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individua… |
CVE-2020-16121 | Low | 3.3 | 2020-11-07 | PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be u… |
CVE-2020-15708 | Critical | 9.3 | 2020-11-06 | Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary fi… |
CVE-2020-28040 | Medium | 4.3 | 2020-11-02 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. |
CVE-2020-28039 | Critical | 9.1 | 2020-11-02 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is… |
CVE-2020-15703 | Medium | 4.0 | 2020-10-31 | There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd… |
CVE-2020-14837 | Medium | 4.9 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exp… |
CVE-2020-15157 | Medium | 6.1 | 2020-10-16 | In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the… |
CVE-2020-25645 | High | 7.5 | 2020-10-13 | A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt tr… |
CVE-2020-14355 | Medium | 6.6 | 2020-10-07 | Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPIC… |
CVE-2020-25641 | Medium | 5.5 | 2020-10-06 | A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could c… |
CVE-2020-7070 | Medium | 4.3 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-dec… |
CVE-2020-7069 | Medium | 5.4 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only… |
CVE-2020-14374 | High | 8.8 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing… |
CVE-2020-14378 | Low | 3.3 | 2020-09-30 | An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in… |
CVE-2020-14377 | High | 7.1 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer o… |
CVE-2020-14376 | High | 7.8 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest memory into host memo… |
CVE-2020-14375 | High | 7.8 | 2020-09-30 | A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessib… |
CVE-2020-26137 | Medium | 6.5 | 2020-09-30 | urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the… |
CVE-2020-26116 | High | 7.2 | 2020-09-27 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTT… |
CVE-2020-26088 | Medium | 5.5 | 2020-09-24 | A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets… |
CVE-2020-25739 | Medium | 6.1 | 2020-09-23 | An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mech… |
CVE-2019-20919 | Medium | 4.7 | 2020-09-17 | An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly t… |
CVE-2020-14382 | High | 7.8 | 2020-09-16 | A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every devic… |
CVE-2020-14392 | Medium | 5.5 | 2020-09-16 | An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory… |
CVE-2020-14385 | Medium | 5.5 | 2020-09-15 | A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable ext… |
CVE-2020-14314 | Medium | 5.5 | 2020-09-15 | A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken in… |
CVE-2020-14362 | High | 7.8 | 2020-09-15 | A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnera… |
CVE-2020-14361 | High | 7.8 | 2020-09-15 | A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnera… |
CVE-2020-14346 | High | 7.8 | 2020-09-15 | A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead to arbitrary access… |
CVE-2020-14345 | High | 7.8 | 2020-09-15 | A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerabilit… |
CVE-2020-8927 | Medium | 5.3 | 2020-09-15 | A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to… |
CVE-2020-25285 | Medium | 6.4 | 2020-09-13 | A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a N… |