This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Canonical First view 2010-09-30
Product Ubuntu Linux Last view 2021-04-17
Version 6.06 Type Os
Update *  
Edition *  
Language *  
Sofware Edition -  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:o:canonical:ubuntu_linux

Activity : Overall

Related : CVE

  Date Alert Description
7.8 2021-04-17 CVE-2021-3493

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

7.8 2021-04-17 CVE-2021-3492

Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.

7.8 2016-12-16 CVE-2016-9950

An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.

7.8 2016-12-16 CVE-2016-9949

An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code.

7.8 2016-11-27 CVE-2015-1328

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.

8.1 2010-09-30 CVE-2010-2943

The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.

CWE : Common Weakness Enumeration

%idName
14% (1) CWE-415 Double Free
14% (1) CWE-401 Failure to Release Memory Before Removing Last Reference ('Memory L...
14% (1) CWE-269 Improper Privilege Management
14% (1) CWE-264 Permissions, Privileges, and Access Controls
14% (1) CWE-200 Information Exposure
14% (1) CWE-94 Failure to Control Generation of Code ('Code Injection')
14% (1) CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path ...

SAINT Exploits

Description Link
Ubuntu overlayfs privilege elevation More info here

Open Source Vulnerability Database (OSVDB)

id Description
68303 Linux Kernel XFS Inode Allocation Btree Stale NFS Filehandle Unlinked File Ac...

OpenVAS Exploits

id Description
2012-03-16 Name : VMSA-2011-0012.3 VMware ESXi and ESX updates to third party libraries and ESX...
File : nvt/gb_VMSA-2011-0012.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2010:0723 centos5 i386
File : nvt/gb_CESA-2010_0723_kernel_centos5_i386.nasl
2011-03-07 Name : Ubuntu Update for linux-lts-backport-maverick vulnerabilities USN-1083-1
File : nvt/gb_ubuntu_USN_1083_1.nasl
2011-02-28 Name : Ubuntu Update for linux vulnerabilities USN-1072-1
File : nvt/gb_ubuntu_USN_1072_1.nasl
2011-02-04 Name : Ubuntu Update for linux-source-2.6.15 vulnerabilities USN-1057-1
File : nvt/gb_ubuntu_USN_1057_1.nasl
2011-01-14 Name : Ubuntu Update for linux, linux-ec2 vulnerabilities USN-1041-1
File : nvt/gb_ubuntu_USN_1041_1.nasl
2010-10-01 Name : RedHat Update for kernel RHSA-2010:0723-01
File : nvt/gb_RHSA-2010_0723-01_kernel.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2011-A-0147 Multiple Vulnerabilities in VMware ESX and ESXi
Severity: Category I - VMSKEY: V0030545

Snort® IPS/IDS

Date Description
2017-01-19 Ubuntu Apport CrashDB crash report code injection attempt
RuleID : 41041 - Type : OS-LINUX - Revision : 2
2017-01-19 Ubuntu Apport CrashDB crash report code injection attempt
RuleID : 41040 - Type : OS-LINUX - Revision : 2

Nessus® Vulnerability Scanner

id Description
2016-12-15 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-3157-1.nasl - Type: ACT_GATHER_INFO
2016-03-04 Name: The remote VMware ESX / ESXi host is missing a security-related patch.
File: vmware_VMSA-2011-0012_remote.nasl - Type: ACT_GATHER_INFO
2015-06-22 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2646-2.nasl - Type: ACT_GATHER_INFO
2015-06-22 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2644-2.nasl - Type: ACT_GATHER_INFO
2015-06-22 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2643-2.nasl - Type: ACT_GATHER_INFO
2015-06-22 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2642-2.nasl - Type: ACT_GATHER_INFO
2015-06-22 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2640-2.nasl - Type: ACT_GATHER_INFO
2015-06-16 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2642-1.nasl - Type: ACT_GATHER_INFO
2015-06-16 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2647-1.nasl - Type: ACT_GATHER_INFO
2015-06-16 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2646-1.nasl - Type: ACT_GATHER_INFO
2015-06-16 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2645-1.nasl - Type: ACT_GATHER_INFO
2015-06-16 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2644-1.nasl - Type: ACT_GATHER_INFO
2015-06-16 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2643-1.nasl - Type: ACT_GATHER_INFO
2015-06-16 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2640-1.nasl - Type: ACT_GATHER_INFO
2013-07-12 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2010-2008.nasl - Type: ACT_GATHER_INFO
2013-07-12 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2010-0723.nasl - Type: ACT_GATHER_INFO
2013-06-29 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2010-0723.nasl - Type: ACT_GATHER_INFO
2013-03-09 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-1083-1.nasl - Type: ACT_GATHER_INFO
2013-03-08 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-1093-1.nasl - Type: ACT_GATHER_INFO
2011-10-14 Name: The remote VMware ESXi / ESX host is missing one or more security-related pat...
File: vmware_VMSA-2011-0012.nasl - Type: ACT_GATHER_INFO
2011-03-09 Name: The remote SuSE 11 host is missing one or more security updates.
File: suse_11_kernel-110228.nasl - Type: ACT_GATHER_INFO
2011-03-01 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-1072-1.nasl - Type: ACT_GATHER_INFO
2011-02-04 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-1057-1.nasl - Type: ACT_GATHER_INFO
2011-01-11 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-1041-1.nasl - Type: ACT_GATHER_INFO
2010-10-06 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2010-0723.nasl - Type: ACT_GATHER_INFO