Vulnerabilidades de Canonical
CVEs publicadas que afetam produtos de Canonical: 283 registro(s), com severidade, exploração e correções.
Ubuntu Linux 210Lxd 36Juju 10Ubuntu 24.04 LTS 8Ubuntu 22.04 LTS 8Ubuntu 26.04 LTS 6Ubuntu 20.04 LTS 6Ubuntu 18.04 LTS 6Ubuntu 16.04 LTS 6Ubuntu 3Ubuntu-pro-client (ubuntu-advantage-tools) 3Multipass 3Apport 2Maas 2Authd 2Ubuntu 14.04 LTS 2Accountsservice 2Canonical-livepatch 1Postgresql-operator 1Microceph 1Pdfunite 1Livepatch Client 1Python-apt 1Ubuntu Desktop Provision 1Ubuntu Subiquity 1Ubuntu Pro for WSL 1
CVE-2019-15219
Média · 4.6
CWE-476 19/08/2019
NULL Pointer Dereference em Linux Linux Kernel
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.
CVE-2019-15218
Média · 4.6
CWE-476 19/08/2019
NULL Pointer Dereference em Linux Linux Kernel
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.
CVE-2019-15217
Média · 4.6
CWE-476 19/08/2019
NULL Pointer Dereference em Linux Linux Kernel
An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.
CVE-2019-13565
Alta · 7.5
26/07/2019
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session...
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
CVE-2019-13057
Média · 4.9
26/07/2019
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator...
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
CVE-2019-14250
Média · 5.5
CWE-190 24/07/2019
Integer Overflow or Wraparound em Gnu Binutils
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.
CVE-2019-13962
Crítica · 9.8
CWE-125 18/07/2019
Out-of-bounds Read em Videolan Vlc Media Player
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-13272
Alta · 7.8
KEV Urgente · 76 Exploit público 17/07/2019
Linux Kernel Improper Privilege Management Vulnerability
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
CVE-2019-13602
Alta · 7.8
CWE-191 14/07/2019
Integer Underflow em Videolan Vlc Media Player
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
CVE-2019-12972
Média · 5.5
CWE-125 26/06/2019
Out-of-bounds Read em Gnu Binutils
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.
CVE-2018-20843
Alta · 7.5
CWE-611 24/06/2019
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of...
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
CVE-2019-12900
Crítica · 9.8
CWE-787 19/06/2019
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are...
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
CVE-2019-10160
Crítica · 9.8
CWE-172 07/06/2019
A security regression of CVE-2019-9636 was discovered in python since commit...
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
CVE-2019-10149
Crítica · 9.8
KEV Urgente · 80 Exploit público CWE-78 05/06/2019
Exim Mail Transfer Agent (MTA) Improper Input Validation
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2019-8457
Crítica · 9.8
CWE-125 30/05/2019
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the...
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
CVE-2019-5018
Alta · 8.1
CWE-416 10/05/2019
An exploitable use after free vulnerability exists in the window function functionality of...
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
CVE-2019-0211
Alta · 7.8
KEV Urgente · 70 Exploit público CWE-416 08/04/2019
Apache HTTP Server Privilege Escalation Vulnerability
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
CVE-2019-9948
Crítica · 9.1
CWE-22 23/03/2019
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for...
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
CVE-2019-9636
Crítica · 9.8
CWE-173 08/03/2019
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode...
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVE-2019-9169
Crítica · 9.8
CWE-125 25/02/2019
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has...
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
CVE-2019-8906
Média · 4.4
CWE-125 18/02/2019
Out-of-bounds Read em File Project File
do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
CVE-2019-6111
Média · 5.9
Exploit público CWE-22 31/01/2019
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp...
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
CVE-2019-6109
Média · 6.8
CWE-116 31/01/2019
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display...
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
CVE-2018-1000880
Média · 6.5
CWE-119 20/12/2018
Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Libarchive
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
CVE-2018-19543
Alta · 7.8
CWE-125 26/11/2018
Out-of-bounds Read em Jasper Project Jasper
An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.