18.10 : Security Vulnerabilities

Cpe Name:cpe:/o:canonical:ubuntu_linux:18.10

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2019-1000020	400		2019-02-04	2019-04-12	4.3	None	Remote	Medium	Not required	None	None	Partial
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.
2	CVE-2019-1000019	125	DoS	2019-02-04	2019-04-12	4.3	None	Remote	Medium	Not required	None	None	Partial
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
3	CVE-2019-12749	287	Bypass	2019-06-11	2019-06-14	3.6	None	Local	Low	Not required	Partial	Partial	None
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.
4	CVE-2019-11596	476	DoS	2019-04-29	2019-05-16	5.0	None	Remote	Low	Not required	None	None	Partial
In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.
5	CVE-2019-11498	824	DoS	2019-04-24	2019-06-04	4.3	None	Remote	Medium	Not required	None	None	Partial
WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.
6	CVE-2019-11479	400	DoS	2019-06-18	2019-06-20	5.0	None	Remote	Low	Not required	None	None	Partial
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
7	CVE-2019-11478	400	DoS	2019-06-18	2019-06-20	5.0	None	Remote	Low	Not required	None	None	Partial
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
8	CVE-2019-11477	190	DoS Overflow	2019-06-18	2019-06-20	7.8	None	Remote	Low	Not required	None	None	Complete
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
9	CVE-2019-11459	824		2019-04-22	2019-06-13	4.3	None	Remote	Medium	Not required	Partial	None	None
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.
10	CVE-2019-11324	295		2019-04-18	2019-06-03	5.0	None	Remote	Low	Not required	None	Partial	None
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
11	CVE-2019-11235	345		2019-04-22	2019-05-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
12	CVE-2019-11234	287		2019-04-22	2019-05-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
13	CVE-2019-11068	284	Bypass	2019-04-10	2019-06-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
14	CVE-2019-11035	119	Overflow	2019-04-18	2019-06-03	6.4	None	Remote	Low	Not required	Partial	None	Partial
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
15	CVE-2019-11034	119	Overflow	2019-04-18	2019-06-03	6.4	None	Remote	Low	Not required	Partial	None	Partial
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
16	CVE-2019-9928	119	Exec Code Overflow	2019-04-24	2019-05-01	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
17	CVE-2019-9917	20	DoS	2019-03-27	2019-06-14	4.0	None	Remote	Low	Single system	None	None	Partial
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
18	CVE-2019-9641	119	Overflow	2019-03-08	2019-06-18	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.
19	CVE-2019-9640	119	Overflow	2019-03-08	2019-06-03	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.
20	CVE-2019-9639	119	Overflow	2019-03-08	2019-06-03	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.
21	CVE-2019-9638	119	Overflow	2019-03-08	2019-06-03	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.
22	CVE-2019-9637	264		2019-03-08	2019-06-03	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.
23	CVE-2019-9628	20		2019-04-11	2019-06-11	5.0	None	Remote	Low	Not required	None	None	Partial
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
24	CVE-2019-9213	476		2019-03-05	2019-06-17	4.9	None	Local	Low	Not required	None	None	Complete
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.
25	CVE-2019-9210	190	Overflow	2019-02-27	2019-04-25	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)
26	CVE-2019-9200	787	DoS	2019-02-26	2019-04-06	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
27	CVE-2019-8980	399	DoS	2019-02-21	2019-05-06	7.8	None	Remote	Low	Not required	None	None	Complete
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
28	CVE-2019-8956	416		2019-04-01	2019-06-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.
29	CVE-2019-8907	119	DoS Overflow	2019-02-18	2019-04-12	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.
30	CVE-2019-8906	125		2019-02-18	2019-04-16	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
31	CVE-2019-8905	125		2019-02-18	2019-04-12	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.
32	CVE-2019-8375	119	DoS Overflow	2019-02-24	2019-05-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp, UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka Epiphany).
33	CVE-2019-7663	119	Overflow	2019-02-09	2019-04-23	4.3	None	Remote	Medium	Not required	None	None	Partial
An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.
34	CVE-2019-7524	119	Overflow	2019-03-28	2019-06-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
35	CVE-2019-7317	416		2019-02-04	2019-06-10	2.6	None	Remote	High	Not required	None	None	Partial
png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute.
36	CVE-2019-7310	125	DoS	2019-02-02	2019-04-18	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.
37	CVE-2019-7308	189		2019-02-01	2019-04-18	4.7	None	Local	Medium	Not required	Complete	None	None
kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.
38	CVE-2019-7304	20		2019-04-23	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
39	CVE-2019-7303	264		2019-04-23	2019-04-30	5.0	None	Remote	Low	Not required	None	Partial	None
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.
40	CVE-2019-7222	200	+Info	2019-03-21	2019-05-13	2.1	None	Local	Low	Not required	Partial	None	None
The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
41	CVE-2019-7221	416		2019-03-21	2019-06-14	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
42	CVE-2019-6978	415		2019-01-28	2019-04-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.
43	CVE-2019-6977	119	Overflow	2019-01-26	2019-04-10	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.
44	CVE-2019-6975	400		2019-02-11	2019-04-25	5.0	None	Remote	Low	Not required	None	None	Partial
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
45	CVE-2019-6974	362		2019-02-15	2019-05-08	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
46	CVE-2019-6778	119	Overflow	2019-03-21	2019-05-31	4.6	None	Local	Low	Not required	Partial	Partial	Partial
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
47	CVE-2019-6706	416		2019-01-23	2019-04-22	5.0	None	Remote	Low	Not required	None	None	Partial
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
48	CVE-2019-6690	20		2019-03-21	2019-06-18	5.0	None	Remote	Low	Not required	None	Partial	None
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
49	CVE-2019-6454	119	DoS Overflow	2019-03-21	2019-06-04	4.9	None	Local	Low	Not required	None	None	Complete
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).
50	CVE-2019-6251	20		2019-01-14	2019-05-15	5.8	None	Remote	Medium	Not required	Partial	Partial	None
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.

Total number of vulnerabilities : 224 Page : 1 (This Page)2 3 4 5