UL
Product
Ubuntu Linux
On CISA KEVExploited in the wildRansomware-linked
4,113
CVEs
47
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 344High 149Medium 6Low 1
Watch
Add Ubuntu Linux to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-7117 | 9.8 | Oct 10 | Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors… Affected: 16.04 |
| CVE-2016-5180 | 9.8 | Oct 3 | Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly… Affected: 12.04; 14.04; 16.04; 16.10 |
| CVE-2016-3955 | 9.8 | Jul 3 | The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or… Affected: 12.04; 12.04; 14.04; 14.04; 15.10 |
| CVE-2016-5118 | 9.8 | Jun 10 | The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a… Affected: 12.04; 14.04; 15.10; 16.04 |
| CVE-2016-0718 | 9.8 | May 26 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow Affected: 12.04; 14.04; 16.04 |
| CVE-2016-1578 | 9.8 | May 13 | Use-after-free vulnerability in Oxide allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to… Affected: 14.04; 15.10; 16.04 |
| CVE-2015-8812 | 9.8 | Apr 27 | drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause… Affected: 12.04; 14.04; 15.10 |
| CVE-2016-4002 | 9.8 | Apr 26 | Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of… Affected: 12.04; 14.04; 15.10; 16.04 |
| CVE-2016-3074 | 9.8 | Apr 26 | Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via… Affected: 12.04; 14.04; 15.10; 16.04 |
| CVE-2015-8779 | 9.8 | Apr 19 | Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service… Affected: 12.04; 14.04; 15.10 |
| CVE-2015-8778 | 9.8 | Apr 19 | Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute… Affected: 12.04; 14.04; 15.10 |
| CVE-2014-9761 | 9.8 | Apr 19 | Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or… Affected: 12.04; 14.04; 15.10 |
| CVE-2016-1659 | 9.8 | Apr 18 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: 14.04; 15.10; 16.04 |
| CVE-2015-7545 | 9.8 | Apr 13 | The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly… Affected: 12.04; 14.04; 15.04; 15.10 |
| CVE-2014-9766 | 9.8 | Apr 13 | Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly… Affected: 12.04; 14.04 |
| CVE-2016-0705 | 9.8 | Mar 3 | Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a… Affected: 12.04; 14.04; 15.10 |
| CVE-2015-8805 | 9.8 | Feb 23 | The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST… Affected: 14.04; 15.10 |
| CVE-2015-8804 | 9.8 | Feb 23 | x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which… Affected: 14.04; 15.10 |
| CVE-2015-8803 | 9.8 | Feb 23 | The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST… Affected: 14.04; 15.10 |
| CVE-2016-0746 | 9.8 | Feb 15 | Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or… Affected: 14.04; 15.10 |
| CVE-2014-1532 | 9.8 | Apr 30 | Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird… Affected: 12.04; 12.10; 13.10; 14.04 |
| CVE-2014-1524 | 9.8 | Apr 30 | The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not… Affected: 12.04; 12.10; 13.10; 14.04 |
| CVE-2014-1514 | 9.8 | Mar 19 | vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the… Affected: 12.04; 12.10; 13.10 |
| CVE-2014-1511 | 9.8 | Mar 19 | Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified… Affected: 12.04; 12.10; 13.10 |
| CVE-2014-1510 | 9.8 | Mar 19 | The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute… Affected: 12.04; 12.10; 13.10 |
| CVE-2014-1493 | 9.8 | Mar 19 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow… Affected: 12.04; 12.10; 13.10 |
| CVE-2014-1486 | 9.8 | Feb 6 | Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24… Affected: 12.04; 12.10; 13.10 |
| CVE-2014-1477 | 9.8 | Feb 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow… Affected: 12.04; 12.10; 13.10 |
| CVE-2013-6671 | 9.8 | Dec 11 | The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2013-5618 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2013-5616 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2013-5615 | 9.8 | Dec 11 | The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2013-5613 | 9.8 | Dec 11 | Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2013-5609 | 9.8 | Dec 11 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: 6.06; 8.04; 9.10; 10.04; 10.10 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: 6.06; 8.04; 9.04; 9.10; 10.04 |
| CVE-2009-4013 | 9.8 | Feb 2 | Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files… Affected: 6.06; 8.04; 8.10; 9.04; 9.10 |
| CVE-2009-3555 | 9.8 | Nov 9 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and… Affected: 8.04; 8.10; 9.04; 9.10; 10.04; 10.10 |
| CVE-2008-2108 | 9.8 | May 7 | The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during… Affected: 6.06; 7.04; 7.10; 8.04 |
| CVE-2008-0599 | 9.8 | May 5 | The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which… Affected: 6.06; 7.04; 7.10; 8.04 |
| CVE-2008-0062 | 9.8 | Mar 19 | KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute… Affected: 6.06; 6.10; 7.04; 7.10 |
| CVE-2007-3798 | 9.8 | Jul 16 | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an… Affected: 6.06; 6.10; 7.04 |
| CVE-2005-1513 | 9.8 | May 11 | Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of… Affected: 20.04 |
| CVE-2004-2154 | 9.8 | Dec 31 | CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or… Affected: 4.10 |
| CVE-2015-8866 | 9.6 | May 22 | ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads,… Affected: 12.04; 14.04; 15.10 |
| CVE-2021-45079 | 9.1 | Jan 31 | In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual… Affected: 14.04; 16.04; 18.04; 20.04; 21.10 |
| CVE-2020-28039 | 9.1 | Nov 2 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered… Affected: 16.04; 18.04; 20.04 |
| CVE-2020-13112 | 9.1 | May 21 | An issue was discovered in libexif before 0.6.22 Affected: 12.04; 14.04; 16.04; 18.04; 19.10; 20.04 |
| CVE-2019-20444 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be… Affected: 18.04 |
| CVE-2019-20445 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header Affected: 18.04 |
The 500 most important CVEs for this product (exploited first, then by severity)