UL
Product
Ubuntu Linux
On CISA KEVExploited in the wildRansomware-linked
4,113
CVEs
47
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 344High 149Medium 6Low 1
Watch
Add Ubuntu Linux to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-5613 | 9.8 | Dec 11 | Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2013-5609 | 9.8 | Dec 11 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow… Affected: 12.04; 12.10; 13.04; 13.10 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: 6.06; 8.04; 9.10; 10.04; 10.10 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: 6.06; 8.04; 9.04; 9.10; 10.04 |
| CVE-2009-4013 | 9.8 | Feb 2 | Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files… Affected: 6.06; 8.04; 8.10; 9.04; 9.10 |
| CVE-2009-3555 | 9.8 | Nov 9 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and… Affected: 8.04; 8.10; 9.04; 9.10; 10.04; 10.10 |
| CVE-2008-2108 | 9.8 | May 7 | The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during… Affected: 6.06; 7.04; 7.10; 8.04 |
| CVE-2008-0599 | 9.8 | May 5 | The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which… Affected: 6.06; 7.04; 7.10; 8.04 |
| CVE-2008-0062 | 9.8 | Mar 19 | KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute… Affected: 6.06; 6.10; 7.04; 7.10 |
| CVE-2007-3798 | 9.8 | Jul 16 | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an… Affected: 6.06; 6.10; 7.04 |
| CVE-2005-1513 | 9.8 | May 11 | Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of… Affected: 20.04 |
| CVE-2004-2154 | 9.8 | Dec 31 | CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or… Affected: 4.10 |
| CVE-2015-8866 | 9.6 | May 22 | ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads,… Affected: 12.04; 14.04; 15.10 |
| CVE-2021-45079 | 9.1 | Jan 31 | In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual… Affected: 14.04; 16.04; 18.04; 20.04; 21.10 |
| CVE-2020-28039 | 9.1 | Nov 2 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered… Affected: 16.04; 18.04; 20.04 |
| CVE-2020-13112 | 9.1 | May 21 | An issue was discovered in libexif before 0.6.22 Affected: 12.04; 14.04; 16.04; 18.04; 19.10; 20.04 |
| CVE-2019-20444 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be… Affected: 18.04 |
| CVE-2019-20445 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header Affected: 18.04 |
| CVE-2019-20367 | 9.1 | Jan 8 | nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab) Affected: 12.04; 14.04; 16.04; 18.04; 19.04 |
| CVE-2019-19949 | 9.1 | Dec 24 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare Affected: 20.04 |
| CVE-2019-12523 | 9.1 | Nov 26 | An issue was discovered in Squid before 4.9 Affected: 16.04; 18.04; 19.04; 19.10; 16.04; 18.04 |
| CVE-2019-17544 | 9.1 | Oct 14 | libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character Affected: 12.04; 14.04; 16.04; 18.04; 19.04 |
| CVE-2019-17134 | 9.1 | Oct 8 | Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based… Affected: 19.04 |
| CVE-2019-15926 | 9.1 | Sep 4 | An issue was discovered in the Linux kernel before 5.2.3 Affected: 16.04; 18.04; 19.10 |
| CVE-2019-10197 | 9.1 | Sep 3 | A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file Affected: 19.04 |
| CVE-2019-11036 | 9.1 | May 3 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in… Affected: 12.04; 14.04; 16.04; 18.04; 18.10; 19.04 |
| CVE-2019-11035 | 9.1 | Apr 18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in… Affected: 12.04; 14.04; 16.04; 18.04; 18.10; 19.04 |
| CVE-2019-11034 | 9.1 | Apr 18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in… Affected: 12.04; 14.04; 16.04; 18.04; 18.10; 19.04 |
| CVE-2019-9948 | 9.1 | Mar 23 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as… Affected: 12.04; 14.04; 16.04; 18.04; 19.04 |
| CVE-2018-18313 | 9.1 | Dec 7 | Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory Affected: 12.04; 14.04; 16.04; 18.04; 18.10 |
| CVE-2018-16842 | 9.1 | Oct 31 | Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of… Affected: 12.04; 14.04; 16.04; 18.04; 18.10 |
| CVE-2018-12387 | 9.1 | Oct 18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout Affected: 14.04; 16.04; 18.04 |
| CVE-2018-10933 | 9.1 | Oct 17 | A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4 Affected: 14.04; 16.04; 18.04; 18.10 |
| CVE-2018-14938 | 9.1 | Aug 5 | An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha Affected: 16.04; 18.04; 18.10 |
| CVE-2018-1000301 | 9.1 | May 24 | curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading… Affected: 12.04; 14.04; 16.04; 17.10; 18.04 |
| CVE-2018-8780 | 9.1 | Apr 3 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL… Affected: 14.04; 16.04; 17.10 |
| CVE-2018-1000122 | 9.1 | Mar 14 | A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage Affected: 12.04; 14.04; 16.04; 17.10 |
| CVE-2018-1000005 | 9.1 | Jan 24 | libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers Affected: 14.04; 16.04; 17.10 |
| CVE-2016-5018 | 9.1 | Aug 10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: 16.04 |
| CVE-2017-6519 | 9.1 | May 1 | avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a… Affected: 12.04; 14.04; 16.04; 18.04; 18.10 |
| CVE-2015-8776 | 9.1 | Apr 19 | The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain… Affected: 12.04; 14.04; 15.10 |
| CVE-2014-1508 | 9.1 | Mar 19 | The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers… Affected: 12.04; 12.10; 13.10 |
| CVE-2018-3183 | 9.0 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Scripting) Affected: 16.04; 18.04; 18.10 |
| CVE-2015-8557 | 9.0 | Jan 8 | The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in… Affected: 12.04; 14.04; 15.04; 15.10 |
The 500 most important CVEs for this product (exploited first, then by severity)