Canonical » Ubuntu Linux : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2018-1000135	200	+Info	2018-03-20	2018-04-20	5.0	None	Remote	Low	Not required	Partial	None	None
GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.
2	CVE-2018-1000127	190	Overflow	2018-03-13	2018-07-31	5.0	None	Remote	Low	Not required	None	None	Partial
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
3	CVE-2018-1000121	476	DoS	2018-03-14	2019-01-16	5.0	None	Remote	Low	Not required	None	None	Partial
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
4	CVE-2018-1000115	20	DoS	2018-03-05	2018-10-03	5.0	None	Remote	Low	Not required	None	None	Partial
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
5	CVE-2018-18074	255		2018-10-09	2018-11-23	5.0	None	Remote	Low	Not required	Partial	None	None
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
6	CVE-2018-17962	119	Overflow	2018-10-09	2018-12-01	5.0	None	Remote	Low	Not required	None	None	Partial
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
7	CVE-2018-17958	190	Overflow	2018-10-09	2018-11-28	5.0	None	Remote	Low	Not required	None	None	Partial
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
8	CVE-2018-17540	119	Overflow	2018-10-03	2018-11-27	5.0	None	Remote	Low	Not required	None	None	Partial
The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate.
9	CVE-2018-16429	125		2018-09-03	2018-10-25	5.0	None	Remote	Low	Not required	None	None	Partial
GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().
10	CVE-2018-16152	347		2018-09-26	2018-12-19	5.0	None	Remote	Low	Not required	None	Partial	None
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.
11	CVE-2018-16151	347		2018-09-26	2018-12-19	5.0	None	Remote	Low	Not required	None	Partial	None
In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication.
12	CVE-2018-14883	190	Overflow	2018-08-03	2018-12-11	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
13	CVE-2018-14647	399	DoS	2018-09-24	2018-12-20	5.0	None	Remote	Low	Not required	None	None	Partial
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. Python 3.8, 3.7, 3.6, 3.5, 3.4, 2.7 are believed to be vulnerable.
14	CVE-2018-14645	125	DoS	2018-09-21	2018-11-28	5.0	None	Remote	Low	Not required	None	None	Partial
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.
15	CVE-2018-14622	769		2018-08-30	2018-12-07	5.0	None	Remote	Low	Not required	None	None	Partial
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.
16	CVE-2018-14598	20	Overflow	2018-08-24	2018-11-09	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).
17	CVE-2018-14574	601		2018-08-03	2018-10-09	5.8	None	Remote	Medium	Not required	Partial	Partial	None
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
18	CVE-2018-14404	476	DoS	2018-07-19	2018-09-28	5.0	None	Remote	Low	Not required	None	None	Partial
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
19	CVE-2018-12700	399		2018-06-23	2018-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
A Stack Exhaustion issue was discovered in debug_write_type in debug.c in GNU Binutils 2.30 because of DEBUG_KIND_INDIRECT infinite recursion.
20	CVE-2018-12698	399		2018-06-23	2018-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.
21	CVE-2018-12697	476		2018-06-23	2018-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.
22	CVE-2018-12386	704	Exec Code	2018-10-18	2018-12-06	5.8	None	Remote	Medium	Not required	Partial	Partial	None
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.
23	CVE-2018-12020	19		2018-06-08	2018-11-30	5.0	None	Remote	Low	Not required	None	Partial	None
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
24	CVE-2018-11233	125		2018-05-30	2018-10-21	5.0	None	Remote	Low	Not required	Partial	None	None
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.
25	CVE-2018-10925	285		2018-08-09	2018-12-14	5.5	None	Remote	Low	Single system	Partial	Partial	None
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.
26	CVE-2018-10903	20		2018-07-30	2018-11-14	5.0	None	Remote	Low	Not required	Partial	None	None
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
27	CVE-2018-10768	476	DoS	2018-05-06	2018-11-07	5.0	None	Remote	Low	Not required	None	None	Partial
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.
28	CVE-2018-10548	476	DoS	2018-04-29	2018-12-03	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.
29	CVE-2018-10546	400		2018-04-29	2018-12-03	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
30	CVE-2018-8779	20		2018-04-03	2018-11-30	5.0	None	Remote	Low	Not required	None	Partial	None
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.
31	CVE-2018-8778	200	+Info	2018-04-03	2018-11-30	5.0	None	Remote	Low	Not required	Partial	None	None
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
32	CVE-2018-8034	295		2018-08-01	2019-01-23	5.0	None	Remote	Low	Not required	Partial	None	None
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
33	CVE-2018-7537	185		2018-03-09	2018-10-17	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
34	CVE-2018-7536	185		2018-03-09	2019-01-17	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
35	CVE-2018-6914	22	Dir. Trav.	2018-04-03	2018-11-30	5.0	None	Remote	Low	Not required	None	Partial	None
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
36	CVE-2018-6798	119	Overflow	2018-04-17	2018-05-21	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.
37	CVE-2018-5381	400	DoS	2018-02-19	2018-10-21	5.0	None	Remote	Low	Not required	None	None	Partial
The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.
38	CVE-2018-5184	326		2018-06-11	2018-11-25	5.0	None	Remote	Low	Not required	Partial	None	None
Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
39	CVE-2018-5182	200	+Info	2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	Partial	None	None
If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60.
40	CVE-2018-5181	200	+Info	2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	Partial	None	None
If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with the "noopener" keyword. This vulnerability affects Firefox < 60.
41	CVE-2018-5180	416		2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	None	None	Partial
A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. This vulnerability affects Firefox < 60.
42	CVE-2018-5177	119	Overflow	2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	None	None	Partial
A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60.
43	CVE-2018-5173	20		2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	None	Partial	None
The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This vulnerability affects Firefox < 60.
44	CVE-2018-5168	275	Bypass	2018-06-11	2018-11-25	5.0	None	Remote	Low	Not required	None	Partial	None
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.
45	CVE-2018-5166	284	Bypass	2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	Partial	None	None
WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. This vulnerability affects Firefox < 60.
46	CVE-2018-5163	264	Exec Code +Priv	2018-06-11	2018-08-03	5.1	None	Remote	High	Not required	Partial	Partial	Partial
If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60.
47	CVE-2018-5162	200	+Info	2018-06-11	2018-11-25	5.0	None	Remote	Low	Not required	Partial	None	None
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
48	CVE-2018-5160	119	Overflow	2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	None	None	Partial
WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder using uninitialized memory, leading to a potentially exploitable crash. This vulnerability affects Firefox < 60.
49	CVE-2018-5157	346	Bypass	2018-06-11	2018-10-20	5.0	None	Remote	Low	Not required	Partial	None	None
Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.
50	CVE-2018-5153	125		2018-06-11	2018-08-14	5.0	None	Remote	Low	Not required	Partial	None	None
If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bounds read with the read memory sent to the originating server in response. This vulnerability affects Firefox < 60.

Total number of vulnerabilities : 281 Page : 1 (This Page)2 3 4 5 6