Export limit exceeded: 425865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,194

Export CSV
CVE-2019-15796

python-apt downloads from untrusted sources

Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Ubuntu
Products
Ubuntu Linux Python-apt Python-apt
CVE-2019-15795

python-apt uses MD5 for validation

python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Ubuntu
Products
Ubuntu Linux Python-apt Python-apt
CVE-2019-15794

Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs

Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2019-15793

Mishandling of file-system uid/gid with namespaces in shiftfs

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whereas they should have been translated into the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, which likely did not map into the shifts s_user_ns. A local attacker could use this to possibly bypass discretionary access control permissions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2019-15792

Type confusion in shiftfs

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.

CVSS 3.1 · 7.1 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2019-15791

Reference count underflow in shiftfs

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.

CVSS 3.1 · 7.1 High EPSS 1.3% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2019-15717

Irssi: use-after-free if the IRC server sends double CAP

Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.

CVSS 3.0 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Canonical Irssi
Products
Ubuntu Linux Irssi
CVE-2019-15681

libvncserver: information disclosure and ASLR bypass

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 12 more
CVE-2019-15538

kernel: denial of service in in xfs_setattr_nonsize in fs/xfs/xfs_iops.c

An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 26 more
CVE-2019-15505

kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c

drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).

CVSS 3.1 · 9.8 Critical EPSS 7.6% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2019-15504

kernel: double free in drivers/net/wireless/rsi/rsi_91x_usb.c via crafted USB device

drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).

CVSS 3.1 · 9.8 Critical EPSS 4.3% KEV · Not listed
Vendors
Canonical Linux
Products
Ubuntu Linux Linux Kernel
CVE-2019-15292

kernel: Use-after-free in atalk_proc_exit function in net/appletalk

An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.

CVSS 3.1 · 4.7 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Debian Linux
Products
Ubuntu Linux Debian Linux Linux Kernel
CVE-2019-15221

kernel: Null pointer dereference in the sound/usb/line6/pcm.c

An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 9 more
CVE-2019-15220

kernel: Use-after-free in drivers/net/wireless/intersil/p54/p54usb.c

An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2019-15216

kernel: null-pointer dereference in drivers/usb/misc/yurex.c driver

An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2019-15215

kernel: use after free in drivers/media/usb/cpia2/cpia2_usb.c driver

An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2019-15214

kernel: use-after-free in sound/core/init.c and sound/core/info.c

An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 1 more
Products
Ubuntu Linux Linux Kernel Leap and 1 more