Summary
Detail | |||
---|---|---|---|
Vendor | Canonical | First view | 2012-09-05 |
Product | Ubuntu Linux | Last view | 2021-04-17 |
Version | 14.10 | Type | Os |
Update | * | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:o:canonical:ubuntu_linux |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
7.8 | 2021-04-17 | CVE-2021-3493 | The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges. |
7.8 | 2021-04-17 | CVE-2021-3492 | Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562. |
7.5 | 2019-11-29 | CVE-2015-3406 | The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors. |
7.5 | 2019-11-20 | CVE-2015-3167 | contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack. |
9.8 | 2019-11-20 | CVE-2015-3166 | The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error. |
5.5 | 2019-11-20 | CVE-2015-1607 | kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges." |
6.5 | 2017-10-10 | CVE-2014-9092 | libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker. |
7.5 | 2017-08-25 | CVE-2015-1395 | Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name. |
7 | 2017-08-25 | CVE-2015-1325 | Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges. |
7.8 | 2017-08-25 | CVE-2015-1324 | Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges by leveraging incorrect handling of permissions when generating core dumps for setuid binaries. |
5.5 | 2017-08-25 | CVE-2014-9637 | GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file. |
5.5 | 2017-07-21 | CVE-2015-1323 | The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions. |
7.8 | 2016-11-27 | CVE-2015-1328 | The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace. |
8.6 | 2016-01-12 | CVE-2015-1779 | The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section. |
4 | 2015-07-16 | CVE-2015-4772 | Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition. |
3.5 | 2015-07-16 | CVE-2015-4771 | Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to RBR. |
3.5 | 2015-07-16 | CVE-2015-4769 | Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4767. |
1.7 | 2015-07-16 | CVE-2015-4767 | Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4769. |
3.5 | 2015-07-16 | CVE-2015-4761 | Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached. |
3.5 | 2015-07-16 | CVE-2015-4757 | Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. |
4 | 2015-07-16 | CVE-2015-4752 | Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S. |
3.5 | 2015-07-16 | CVE-2015-4737 | Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth. |
2.1 | 2015-07-16 | CVE-2015-2661 | Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows local users to affect availability via unknown vectors related to Client. |
4 | 2015-07-16 | CVE-2015-2648 | Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML. |
4 | 2015-07-16 | CVE-2015-2643 | Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
26% (46) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
9% (16) | CWE-399 | Resource Management Errors |
9% (16) | CWE-17 | Code |
8% (15) | CWE-264 | Permissions, Privileges, and Access Controls |
6% (11) | CWE-20 | Improper Input Validation |
4% (8) | CWE-200 | Information Exposure |
4% (8) | CWE-189 | Numeric Errors |
2% (5) | CWE-269 | Improper Privilege Management |
2% (5) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
2% (4) | CWE-476 | NULL Pointer Dereference |
2% (4) | CWE-310 | Cryptographic Issues |
2% (4) | CWE-284 | Access Control (Authorization) Issues |
1% (3) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
1% (3) | CWE-191 | Integer Underflow (Wrap or Wraparound) |
1% (3) | CWE-190 | Integer Overflow or Wraparound |
1% (3) | CWE-125 | Out-of-bounds Read |
1% (3) | CWE-19 | Data Handling |
1% (2) | CWE-787 | Out-of-bounds Write |
1% (2) | CWE-416 | Use After Free |
1% (2) | CWE-362 | Race Condition |
1% (2) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
1% (2) | CWE-77 | Improper Sanitization of Special Elements used in a Command ('Comma... |
0% (1) | CWE-681 | Incorrect Conversion between Numeric Types |
0% (1) | CWE-611 | Information Leak Through XML External Entity File Disclosure |
0% (1) | CWE-415 | Double Free |
SAINT Exploits
Description | Link |
---|---|
Ubuntu overlayfs privilege elevation | More info here |
ExploitDB Exploits
id | Description |
---|---|
35359 | tcpdump 4.6.2 Geonet Decoder Denial of Service |
OpenVAS Exploits
id | Description |
---|---|
2012-11-26 | Name : Fedora Update for insight FEDORA-2012-18300 File : nvt/gb_fedora_2012_18300_insight_fc16.nasl |
2012-11-26 | Name : Fedora Update for insight FEDORA-2012-18311 File : nvt/gb_fedora_2012_18311_insight_fc17.nasl |
Information Assurance Vulnerability Management (IAVM)
id | Description |
---|---|
2015-A-0199 | Multiple Vulnerabilities in Apple Mac OS X Severity: Category I - VMSKEY: V0061337 |
2015-A-0174 | Multiple Vulnerabilities in Apache HTTP Server Severity: Category I - VMSKEY: V0061135 |
2015-A-0155 | Multiple Vulnerabilities in Oracle MySQL Product Suite Severity: Category I - VMSKEY: V0061083 |
2015-A-0158 | Multiple Vulnerabilities in Oracle Java SE Severity: Category I - VMSKEY: V0061089 |
2015-A-0160 | Multiple Vulnerabilities in Oracle Linux and Virtualization Severity: Category I - VMSKEY: V0061123 |
2015-B-0087 | Multiple Vulnerabilities in IBM WebSphere Portal Severity: Category I - VMSKEY: V0061053 |
2015-A-0141 | Multiple Security Vulnerabilities in IBM WebSphere Application Server Severity: Category I - VMSKEY: V0061061 |
2015-B-0068 | Multiple Vulnerabilities in PostgreSQL Severity: Category I - VMSKEY: V0060809 |
2015-A-0042 | Samba Remote Code Execution Vulnerability Severity: Category I - VMSKEY: V0058919 |
2015-A-0038 | Multiple Vulnerabilities in GNU C Library (glibc) Severity: Category I - VMSKEY: V0058753 |
Snort® IPS/IDS
Date | Description |
---|---|
2017-04-12 | cURL and libcurl set-cookie remote code execution attempt RuleID : 41853 - Type : OS-LINUX - Revision : 4 |
2016-03-14 | Squid Pinger IPv6 denial of service attempt RuleID : 36651 - Type : PROTOCOL-ICMP - Revision : 2 |
2016-03-14 | Squid Pinger IPv6 denial of service attempt RuleID : 36650 - Type : PROTOCOL-ICMP - Revision : 2 |
2015-10-01 | QEMU VNC set-pixel-format memory corruption attempt RuleID : 35851 - Type : SERVER-OTHER - Revision : 2 |
2015-08-18 | LibreOffice Impress socket manager Use After Free attempt RuleID : 35253 - Type : SERVER-OTHER - Revision : 3 |
2015-06-03 | GNU Mailman listname directory traversal attempt RuleID : 34301 - Type : SERVER-OTHER - Revision : 2 |
2015-04-14 | Samba smbd _netr_ServerPasswordSet deprecated vulnerable function access attempt RuleID : 33826 - Type : SERVER-SAMBA - Revision : 3 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33806 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33805 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33804 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33803 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33802 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33801 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL export grade ciphersuite server negotiation attempt RuleID : 33800 - Type : SERVER-OTHER - Revision : 6 |
2015-04-14 | SSL export grade ciphersuite server negotiation attempt RuleID : 33799 - Type : SERVER-OTHER - Revision : 6 |
2015-04-14 | SSL export grade ciphersuite server negotiation attempt RuleID : 33798 - Type : SERVER-OTHER - Revision : 6 |
2015-04-14 | SSL export grade ciphersuite server negotiation attempt RuleID : 33797 - Type : SERVER-OTHER - Revision : 6 |
2015-04-14 | SSL export grade ciphersuite server negotiation attempt RuleID : 33796 - Type : SERVER-OTHER - Revision : 6 |
2015-04-14 | SSL export grade ciphersuite server negotiation attempt RuleID : 33795 - Type : SERVER-OTHER - Revision : 6 |
2015-04-14 | SSL export grade ciphersuite server negotiation attempt RuleID : 33794 - Type : SERVER-OTHER - Revision : 6 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33793 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33792 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33791 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33790 - Type : SERVER-OTHER - Revision : 5 |
2015-04-14 | SSL request for export grade ciphersuite attempt RuleID : 33789 - Type : SERVER-OTHER - Revision : 5 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2019-01-16 | Name: The remote database server is affected by multiple vulnerabilities File: mariadb_5_5_42.nasl - Type: ACT_GATHER_INFO |
2018-12-18 | Name: The remote device is missing a vendor-supplied security patch. File: f5_bigip_SOL16365.nasl - Type: ACT_GATHER_INFO |
2018-11-21 | Name: The remote EulerOS Virtualization host is missing multiple security updates. File: EulerOS_SA-2018-1374.nasl - Type: ACT_GATHER_INFO |
2018-10-26 | Name: The remote EulerOS Virtualization host is missing multiple security updates. File: EulerOS_SA-2018-1344.nasl - Type: ACT_GATHER_INFO |
2018-09-18 | Name: The remote EulerOS Virtualization host is missing a security update. File: EulerOS_SA-2018-1272.nasl - Type: ACT_GATHER_INFO |
2018-05-11 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2018-1017.nasl - Type: ACT_GATHER_INFO |
2018-04-27 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2018-0805.nasl - Type: ACT_GATHER_INFO |
2018-02-01 | Name: The remote Debian host is missing a security update. File: debian_DLA-1265.nasl - Type: ACT_GATHER_INFO |
2017-11-27 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2017-1298.nasl - Type: ACT_GATHER_INFO |
2017-11-27 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2017-3048-1.nasl - Type: ACT_GATHER_INFO |
2017-10-30 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201710-30.nasl - Type: ACT_GATHER_INFO |
2017-10-30 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2017-1201.nasl - Type: ACT_GATHER_INFO |
2017-09-08 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2017-1165.nasl - Type: ACT_GATHER_INFO |
2017-09-08 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2017-1166.nasl - Type: ACT_GATHER_INFO |
2017-09-08 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2017-1171.nasl - Type: ACT_GATHER_INFO |
2017-09-08 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2017-1172.nasl - Type: ACT_GATHER_INFO |
2017-08-25 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2017-1842.nasl - Type: ACT_GATHER_INFO |
2017-08-25 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2017-1854.nasl - Type: ACT_GATHER_INFO |
2017-08-25 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2017-1860.nasl - Type: ACT_GATHER_INFO |
2017-08-22 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20170801_kernel_on_SL7_x.nasl - Type: ACT_GATHER_INFO |
2017-08-22 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20170801_libtasn1_on_SL7_x.nasl - Type: ACT_GATHER_INFO |
2017-08-22 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20170801_pidgin_on_SL7_x.nasl - Type: ACT_GATHER_INFO |
2017-08-09 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2017-1842.nasl - Type: ACT_GATHER_INFO |
2017-08-09 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2017-1854.nasl - Type: ACT_GATHER_INFO |
2017-08-09 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2017-1860.nasl - Type: ACT_GATHER_INFO |