Ubuntu : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complex ity	Authen tication	Confiden tiality	Integrity	Availa bility
1	CVE-2011-1842	20		+Priv	2011-05-02	2011-09-06	7.2	None	Local	Low	Not required	Complete	Complete	Complete
dbus_backend/lsd.py in the D-Bus backend in language-selector before 0.6.7 does not validate the arguments to the (1) SetSystemDefaultLangEnv and (2) SetSystemDefaultLanguageEnv functions, which allows local users to gain privileges via shell metacharacters in a string argument, a different vulnerability than CVE-2011-0729.
2	CVE-2011-0729	264			2011-04-29	2011-07-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
dbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not restrict access on the basis of a PolicyKit check result, which allows local users to modify the /etc/default/locale and /etc/environment files via a (1) SetSystemDefaultLangEnv or (2) SetSystemDefaultLanguageEnv call.
3	CVE-2011-0724	310		+Priv	2011-02-18	2011-04-22	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private keys after installation, which causes each installation to have the same fixed key, which allows remote attackers to gain privileges.
4	CVE-2010-0834	287		Exec Code	2010-08-10	2010-08-10	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.
5	CVE-2010-0832	59	1		2010-07-12	2010-07-13	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to "user file stamps" and the motd.legal-notice file.
6	CVE-2009-3232	287		Bypass	2009-09-17	2009-09-17	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
7	CVE-2009-1601	264		Bypass	2009-05-11	2009-05-12	6.8	None	Local	Low	Single system	Complete	Complete	Complete
The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working directory to the clamav account, which might allow local users to bypass intended access restrictions via read or write operations involving this directory.
8	CVE-2009-1573	264		+Priv	2009-05-06	2010-05-27	4.6	None	Local	Low	Not required	Partial	Partial	Partial
xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows local users to gain privileges by listing the process and its arguments.
9	CVE-2009-1296	200		+Info	2009-06-09	2009-06-23	1.9	None	Local	Medium	Not required	Partial	None	None
The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root.
10	CVE-2009-1295	16			2009-04-30	2009-05-15	1.9	None	Local	Medium	Not required	None	Partial	None
Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the application's crash-report directory, which allows local users to delete arbitrary files via unspecified vectors.
11	CVE-2009-0578	264			2009-03-04	2010-08-21	6.2	None	Local	Low	Single system	None	Complete	Complete
GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
12	CVE-2009-0365	264			2009-03-04	2010-08-21	4.6	None	Local	Low	Single system	Complete	None	None
nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler.
13	CVE-2008-6792	310			2009-05-07	2009-05-16	5.0	None	Remote	Low	Not required	Partial	None	None
system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and consequently limits effective password lengths to eight characters, which makes it easier for context-dependent attackers to successfully conduct brute-force password attacks.
14	CVE-2008-4395	119		Exec Code Overflow	2008-11-06	2012-04-16	8.3	None	Local Network	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in the ndiswrapper module 1.53 for the Linux kernel 2.6 allow remote attackers to execute arbitrary code by sending packets over a local wireless network that specify long ESSIDs.
15	CVE-2008-4306	119		Overflow	2008-11-04	2010-08-21	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence.
16	CVE-2008-2285	310			2008-05-18	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The ssh-vulnkey tool on Ubuntu Linux 7.04, 7.10, and 8.04 LTS does not recognize authorized_keys lines that contain options, which makes it easier for remote attackers to exploit CVE-2008-0166 by guessing a key that was not identified by this tool.
17	CVE-2007-5365	119	1	DoS Exec Code Overflow	2007-10-11	2011-08-02	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
18	CVE-2007-4601	264		Bypass	2007-08-30	2008-11-15	5.0	None	Remote	Low	Not required	Partial	None	None
A regression error in tcp-wrappers 7.6.dbs-10 and 7.6.dbs-11 might allow remote attackers to bypass intended access restrictions when a service uses libwrap but does not specify server connection information.
19	CVE-2007-1352			Exec Code Overflow	2007-04-05	2010-11-30	3.8	None	Local Network	Medium	Single system	None	Partial	Partial
Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.
20	CVE-2007-1351	189		Exec Code Overflow	2007-04-05	2010-11-30	8.5	Admin	Remote	Medium	Single system	Complete	Complete	Complete
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
21	CVE-2006-7229	399		DoS	2007-11-14	2008-09-05	7.8	None	Remote	Low	Not required	None	None	Complete
The skge driver 1.5 in Linux kernel 2.6.15 on Ubuntu does not properly use the spin_lock and spin_unlock functions, which allows remote attackers to cause a denial of service (machine crash) via a flood of network traffic.
22	CVE-2006-6235			Exec Code	2006-12-07	2010-08-21	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
23	CVE-2006-5649			DoS	2006-12-13	2008-09-05	4.6	None	Local	Low	Single system	None	None	Complete
Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspecified vectors.
24	CVE-2006-5648			DoS	2006-12-13	2008-09-05	4.6	None	Local	Low	Single system	None	None	Complete
Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.
25	CVE-2006-5466			Exec Code Overflow	2006-11-06	2010-09-15	5.4	None	Remote	High	Not required	None	None	Complete
Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code via crafted RPM packages.
26	CVE-2006-3747	189		DoS Exec Code	2006-07-28	2011-09-06	7.6	Admin	Remote	High	Not required	Complete	Complete	Complete
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
27	CVE-2006-3597				2006-07-18	2008-09-05	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and uses the main menu, which causes the password to be zeroed out in the installer's memory.
28	CVE-2006-3378			+Priv	2006-07-06	2008-09-05	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits.
29	CVE-2006-1183			+Priv	2006-03-13	2008-09-05	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.
30	CVE-2006-0151			+Priv	2006-01-09	2010-04-02	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.
31	CVE-2005-3625	399		DoS	2005-12-31	2010-10-18	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."
32	CVE-2005-3624	189		Overflow	2005-12-31	2010-11-19	5.0	None	Remote	Low	Not required	None	Partial	None
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.
33	CVE-2005-1527			Exec Code	2005-08-15	2008-09-05	5.0	None	Remote	Low	Not required	None	Partial	None
Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.
34	CVE-2005-1260			DoS	2005-05-19	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb").
35	CVE-2005-0988				2005-05-02	2010-08-21	3.7	None	Local	High	Not required	Partial	Partial	Partial
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.
36	CVE-2005-0754			Exec Code	2005-04-22	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Kommander in KDE 3.2 through KDE 3.4.0 executes data files without confirmation from the user, which allows remote attackers to execute arbitrary code.
37	CVE-2005-0750			+Priv	2005-03-27	2010-08-21	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
38	CVE-2005-0384			DoS	2005-03-15	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client.
39	CVE-2005-0206			Overflow	2005-04-27	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.
40	CVE-2005-0156			Exec Code Overflow	2005-02-07	2010-08-21	2.1	None	Local	Low	Not required	None	Partial	None
Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.
41	CVE-2005-0109			+Info	2005-03-05	2010-08-21	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.
42	CVE-2005-0106				2005-05-03	2009-11-13	4.6	None	Local	Low	Not required	Partial	Partial	Partial
SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.
43	CVE-2005-0080				2005-05-02	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address.
44	CVE-2005-0077				2005-05-02	2010-08-21	2.1	None	Local	Low	Not required	None	Partial	None
The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file.
45	CVE-2004-1337			+Priv	2004-12-23	2008-09-05	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The POSIX Capability Linux Security Module (LSM) for Linux kernel 2.6 does not properly handle the credentials of a process that is launched before the module is loaded, which allows local users to gain privileges.
46	CVE-2004-1235			Exec Code	2005-04-14	2010-08-21	6.2	Admin	Local	High	Not required	Complete	Complete	Complete
Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
47	CVE-2004-1151			Overflow +Priv	2005-01-10	2008-09-10	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in the (1) sys32_ni_syscall and (2) sys32_vm86_warning functions in sys_ia32.c for Linux 2.6.x may allow local attackers to modify kernel memory and gain privileges.
48	CVE-2004-1137			DoS Exec Code	2005-01-10	2010-08-21	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function, which decrements a counter to -1, or (2) the igmp_marksources function, which does not properly validate IGMP message parameters and performs an out-of-bounds read.
49	CVE-2004-1069			DoS	2005-01-10	2008-09-10	1.2	None	Local	High	Not required	None	None	Partial
Race condition in SELinux 2.6.x through 2.6.9 allows local users to cause a denial of service (kernel crash) via SOCK_SEQPACKET unix domain sockets, which are not properly handled in the sock_dgram_sendmsg function.
50	CVE-2004-1068			+Priv	2005-01-10	2010-08-21	6.2	Admin	Local	High	Not required	Complete	Complete	Complete
A "missing serialization" error in the unix_dgram_recvmsg function in Linux 2.4.27 and earlier, and 2.6.x up to 2.6.9, allows local users to gain privileges via a race condition.

Total number of vulnerabilities : 80 Page : 1 (This Page)2