Canonical » Ubuntu Linux : Security Vulnerabilities (CVSS score between 7 and 7.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2022-34918	843	Overflow	2022-07-04	2022-10-26	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
2	CVE-2022-29581	416		2022-05-17	2022-10-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
3	CVE-2021-45417	787	Overflow	2022-01-20	2022-01-26	7.2	None	Local	Low	Not required	Complete	Complete	Complete
AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.
4	CVE-2021-44420		Bypass	2021-12-08	2022-07-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
5	CVE-2021-4093	125		2022-02-18	2023-01-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.
6	CVE-2021-4034	787	Exec Code	2022-01-28	2023-02-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
7	CVE-2021-3939	763		2021-11-17	2021-11-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.
8	CVE-2021-3737	400		2022-03-04	2023-02-02	7.1	None	Remote	Medium	Not required	None	None	Complete
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
9	CVE-2021-3560	754	Bypass	2022-02-16	2022-07-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
10	CVE-2021-3493	269	+Priv	2021-04-17	2022-10-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
11	CVE-2021-3492	415	DoS +Priv	2021-04-17	2021-05-21	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.
12	CVE-2021-3491	787	Exec Code Overflow Bypass	2021-06-04	2021-09-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
13	CVE-2021-3490	125	Exec Code	2021-06-04	2021-09-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
14	CVE-2021-3489	787	Exec Code	2021-06-04	2021-09-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).
15	CVE-2020-24606	20	DoS	2020-08-24	2021-07-21	7.1	None	Remote	Medium	Not required	None	None	Complete
Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.
16	CVE-2020-15900	787	Mem. Corr.	2020-07-28	2022-04-27	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
17	CVE-2020-15862	269		2020-08-20	2020-09-04	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.
18	CVE-2020-15861	59		2020-08-20	2022-12-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.
19	CVE-2020-15780	862	Bypass	2020-07-15	2022-04-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.
20	CVE-2020-14374	120	Overflow	2020-09-30	2022-10-29	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhost_crypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
21	CVE-2020-14356	476		2020-08-19	2023-02-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.
22	CVE-2020-14001	862	Exec Code	2020-07-17	2022-04-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
23	CVE-2020-13974	190	Overflow	2020-06-09	2023-02-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.
24	CVE-2020-13753	20	Exec Code	2020-07-14	2023-01-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
25	CVE-2020-12861	787	Exec Code Overflow	2020-06-24	2022-11-21	7.9	None	Local Network	Medium	Not required	Complete	Complete	Complete
A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080.
26	CVE-2020-12066	20		2020-04-22	2022-04-29	7.8	None	Remote	Low	Not required	None	None	Complete
CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server.
27	CVE-2020-11984	120		2020-08-07	2021-06-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
28	CVE-2020-11945	190	Exec Code Overflow	2020-04-23	2021-03-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).
29	CVE-2020-11651			2020-04-30	2022-07-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
30	CVE-2020-10936	269		2020-05-27	2022-11-08	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Sympa before 6.2.56 allows privilege escalation.
31	CVE-2020-10683	611		2020-05-01	2022-07-25	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
32	CVE-2020-10109	444		2020-03-12	2022-04-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
33	CVE-2020-10108	444		2020-03-12	2022-04-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
34	CVE-2020-10018	416	Exec Code Mem. Corr.	2020-03-02	2022-04-22	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.
35	CVE-2020-8835	125		2020-04-02	2023-02-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
36	CVE-2020-8492	400	DoS	2020-01-30	2021-09-16	7.1	None	Remote	Medium	Not required	None	None	Complete
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
37	CVE-2020-8450	119	Overflow	2020-02-04	2021-07-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy.
38	CVE-2020-6831	120	Overflow Mem. Corr.	2020-05-26	2021-07-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
39	CVE-2020-6814	787	Mem. Corr.	2020-03-25	2022-04-18	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
40	CVE-2020-6061	125	+Info	2020-02-19	2022-06-07	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.
41	CVE-2020-5312	120	Overflow	2020-01-03	2020-07-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
42	CVE-2020-5311	120	Overflow	2020-01-03	2020-07-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
43	CVE-2019-1010238	787	Exec Code Overflow	2019-07-19	2022-04-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
44	CVE-2019-20788	787	Overflow	2020-04-23	2022-03-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
45	CVE-2019-20421	835	DoS	2020-01-27	2021-09-14	7.8	None	Remote	Low	Not required	None	None	Complete
In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
46	CVE-2019-19948	787	Overflow	2019-12-24	2022-10-31	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.
47	CVE-2019-19813	416		2019-12-17	2021-03-12	7.1	None	Remote	Medium	Not required	None	None	Complete
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.
48	CVE-2019-19807	416		2019-12-15	2023-01-17	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
49	CVE-2019-19725	415		2019-12-11	2022-12-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
50	CVE-2019-19330	74		2019-11-27	2020-04-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Total number of vulnerabilities : 678 Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14