{"cves":[{"id":"CVE-2023-1636","published":"2023-09-24T01:15:00","updated_at":"2025-08-26T00:07:35.502085+00:00","description":"\nA vulnerability was found in OpenStack Barbican containers. This\nvulnerability is only applicable to deployments that utilize an all-in-one\nconfiguration. Barbican containers share the same CGROUP, USER, and NET\nnamespace with the host system and other OpenStack services. If any service\nis compromised, it could gain access to the data transmitted to and from\nBarbican.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"as of 2023-11-27, no details if this is a Red Hat specific issue\nor if it also applies to Debian/Ubuntu, see Red Hat bug\nPer Debian, this appears to be a Red Hat specific issue"}],"codename":null,"priority":"medium","cvss3":5.0,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2023-1636"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=2181765"],"patches":{"barbican":[]},"tags":{},"packages":[{"name":"barbican","source":"https://ubuntu.com/security/cve?package=barbican","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=barbican","debian":"https://tracker.debian.org/pkg/barbican","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was deferred [2023-11-27]","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-1633","published":"2023-09-24T01:15:00","updated_at":"2025-08-26T00:07:35.502085+00:00","description":"\nA credentials leak flaw was found in OpenStack Barbican. This flaw allows a\nlocal authenticated attacker to read the configuration file, gaining access\nto sensitive credentials.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"probably Red Hat specific issue, fix appears to be in spec file"}],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2023-1633"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=2181761"],"patches":{"barbican":["vendor: https://review.rdoproject.org/r/c/openstack/barbican-distgit/+/48529"]},"tags":{},"packages":[{"name":"barbican","source":"https://ubuntu.com/security/cve?package=barbican","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=barbican","debian":"https://tracker.debian.org/pkg/barbican","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was deferred [2023-10-26]","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-42821","published":"2023-09-22T17:15:00","updated_at":"2025-07-11T07:55:56.798631+00:00","description":"\nThe package `github.com/gomarkdown/markdown` is a Go library for parsing\nMarkdown text and rendering as HTML. Prior to pseudoversion\n`0.0.0-20230922105210-14b16010c2ee`, which corresponds with commit\n`14b16010c2ee7ff33a940a541d993bd043a88940`, parsing malformed markdown\ninput with parser that uses parser.Mmark extension could result in\nout-of-bounds read vulnerability. To exploit the vulnerability, parser\nneeds to have `parser.Mmark` extension set. The panic occurs inside the\n`citation.go` file on the line 69 when the parser tries to access the\nelement past its length. This can result in a denial of service. Commit\n`14b16010c2ee7ff33a940a541d993bd043a88940`/pseudoversion\n`0.0.0-20230922105210-14b16010c2ee` contains a patch for this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/gomarkdown/markdown/commit/14b16010c2ee7ff33a940a541d993bd043a88940","https://github.com/gomarkdown/markdown/security/advisories/GHSA-m9xq-6h2j-65r2","https://github.com/gomarkdown/markdown/blob/7478c230c7cd3e7328803d89abe591d0b61c41e4/parser/citation.go#L69","https://www.cve.org/CVERecord?id=CVE-2023-42821"],"bugs":[""],"patches":{"golang-github-gomarkdown-markdown":[]},"tags":{},"packages":[{"name":"golang-github-gomarkdown-markdown","source":"https://ubuntu.com/security/cve?package=golang-github-gomarkdown-markdown","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=golang-github-gomarkdown-markdown","debian":"https://tracker.debian.org/pkg/golang-github-gomarkdown-markdown","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43770","published":"2023-09-22T06:15:00","updated_at":"2025-08-26T18:44:47.359173+00:00","description":"\nRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows\nXSS via text/plain e-mail messages with crafted links because of\nprogram/lib/Roundcube/rcube_string_replacer.php behavior.","ubuntu_description":"","notes":[{"author":"","note":"Priority reason:\nListed in CISA Known Exploited Vulnerabilities Catalog"}],"codename":null,"priority":"high","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://roundcube.net/news/2023/09/15/security-update-1.6.3-released","https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b","https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html","https://ubuntu.com/security/notices/USN-6654-1","https://www.cve.org/CVERecord?id=CVE-2023-43770","https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1052059"],"patches":{"roundcube":[]},"tags":{},"packages":[{"name":"roundcube","source":"https://ubuntu.com/security/cve?package=roundcube","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=roundcube","debian":"https://tracker.debian.org/pkg/roundcube","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.3+dfsg-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.3.6+dfsg.1-1ubuntu0.1~esm3","component":null,"pocket":"esm-apps"},{"release_codename":"focal","status":"released","description":"1.4.3+dfsg.1-1ubuntu0.1~esm3","component":null,"pocket":"esm-apps"},{"release_codename":"mantic","status":"released","description":"1.6.2+dfsg-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.5.0+dfsg.1-2ubuntu0.1~esm2","component":null,"pocket":"esm-apps"},{"release_codename":"xenial","status":"released","description":"1.2~beta+dfsg.1-0ubuntu1+esm3","component":null,"pocket":"esm-apps"},{"release_codename":"noble","status":"not-affected","description":"1.6.6+dfsg-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.6.6+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.6.6+dfsg-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.6.6+dfsg-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.6.6+dfsg-1","component":null,"pocket":"security"}]}],"notices_ids":["USN-6654-1"],"notices":[{"id":"USN-6654-1","title":"Roundcube Webmail vulnerability","summary":"Roundcube Webmail could allow cross-site scripting (XSS) attacks.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-02-26T03:46:59.131387","description":"It was discovered that Roundcube Webmail incorrectly sanitized characters\nin the linkrefs text messages. An attacker could possibly use this issue to\nexecute a cross-site scripting (XSS) attack. (CVE-2023-43770)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"roundcube","version":"1.3.6+dfsg.1-1ubuntu0.1~esm3","description":"skinnable AJAX based webmail solution for IMAP servers","is_source":true},{"name":"roundcube","version":"1.3.6+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-core","version":"1.3.6+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-mysql","version":"1.3.6+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-pgsql","version":"1.3.6+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-plugins","version":"1.3.6+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-sqlite3","version":"1.3.6+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"roundcube","version":"1.4.3+dfsg.1-1ubuntu0.1~esm3","description":"skinnable AJAX based webmail solution for IMAP servers","is_source":true},{"name":"roundcube","version":"1.4.3+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-core","version":"1.4.3+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-mysql","version":"1.4.3+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-pgsql","version":"1.4.3+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-plugins","version":"1.4.3+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-sqlite3","version":"1.4.3+dfsg.1-1ubuntu0.1~esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"}],"jammy":[{"name":"roundcube","version":"1.5.0+dfsg.1-2ubuntu0.1~esm2","description":"skinnable AJAX based webmail solution for IMAP servers","is_source":true},{"name":"roundcube","version":"1.5.0+dfsg.1-2ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-core","version":"1.5.0+dfsg.1-2ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-mysql","version":"1.5.0+dfsg.1-2ubuntu0.1~esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-pgsql","version":"1.5.0+dfsg.1-2ubuntu0.1~esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-plugins","version":"1.5.0+dfsg.1-2ubuntu0.1~esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-sqlite3","version":"1.5.0+dfsg.1-2ubuntu0.1~esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"}],"mantic":[{"name":"roundcube","version":"1.6.2+dfsg-1ubuntu0.1","description":"skinnable AJAX based webmail solution for IMAP servers","is_source":true},{"name":"roundcube","version":"1.6.2+dfsg-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":"https://launchpad.net/ubuntu/+source/roundcube/1.6.2+dfsg-1ubuntu0.1","pocket":"security"},{"name":"roundcube-core","version":"1.6.2+dfsg-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":"https://launchpad.net/ubuntu/+source/roundcube/1.6.2+dfsg-1ubuntu0.1","pocket":"security"},{"name":"roundcube-mysql","version":"1.6.2+dfsg-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":"https://launchpad.net/ubuntu/+source/roundcube/1.6.2+dfsg-1ubuntu0.1","pocket":"security"},{"name":"roundcube-pgsql","version":"1.6.2+dfsg-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":"https://launchpad.net/ubuntu/+source/roundcube/1.6.2+dfsg-1ubuntu0.1","pocket":"security"},{"name":"roundcube-plugins","version":"1.6.2+dfsg-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":"https://launchpad.net/ubuntu/+source/roundcube/1.6.2+dfsg-1ubuntu0.1","pocket":"security"},{"name":"roundcube-sqlite3","version":"1.6.2+dfsg-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":"https://launchpad.net/ubuntu/+source/roundcube/1.6.2+dfsg-1ubuntu0.1","pocket":"security"}],"xenial":[{"name":"roundcube","version":"1.2~beta+dfsg.1-0ubuntu1+esm3","description":"skinnable AJAX based webmail solution for IMAP servers","is_source":true},{"name":"roundcube","version":"1.2~beta+dfsg.1-0ubuntu1+esm3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-core","version":"1.2~beta+dfsg.1-0ubuntu1+esm3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-mysql","version":"1.2~beta+dfsg.1-0ubuntu1+esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-pgsql","version":"1.2~beta+dfsg.1-0ubuntu1+esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-plugins","version":"1.2~beta+dfsg.1-0ubuntu1+esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"},{"name":"roundcube-sqlite3","version":"1.2~beta+dfsg.1-0ubuntu1+esm3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/roundcube","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2023-43770"]}]},{"id":"CVE-2023-41993","published":"2023-09-21T19:15:00","updated_at":"2025-08-26T00:14:45.942829+00:00","description":"\nThe issue was addressed with improved checks. This issue is fixed in macOS\nSonoma 14. Processing web content may lead to arbitrary code execution.\nApple is aware of a report that this issue may have been actively exploited\nagainst versions of iOS before iOS 16.7.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"webkit receives limited support. For details, see\nhttps://wiki.ubuntu.com/SecurityTeam/FAQ#webkit\nwebkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8"},{"author":"mdeslaur","note":"It is no longer possible to build new webkit2gtk versions on\nfocal and earlier. Marking as ignored."}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://webkitgtk.org/security/WSA-2023-0009.html","https://www.openwall.com/lists/oss-security/2023/09/28/3","https://ubuntu.com/security/notices/USN-6426-1","https://www.cve.org/CVERecord?id=CVE-2023-41993","https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"bugs":[""],"patches":{"webkitgtk":[],"webkit2gtk":[],"qtwebkit-source":[],"qtwebkit-opensource-src":[],"wpewebkit":[]},"tags":{},"packages":[{"name":"wpewebkit","source":"https://ubuntu.com/security/cve?package=wpewebkit","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=wpewebkit","debian":"https://tracker.debian.org/pkg/wpewebkit","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"qtwebkit-opensource-src","source":"https://ubuntu.com/security/cve?package=qtwebkit-opensource-src","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qtwebkit-opensource-src","debian":"https://tracker.debian.org/pkg/qtwebkit-opensource-src","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"ignored","description":"","component":null,"pocket":"security"}]},{"name":"qtwebkit-source","source":"https://ubuntu.com/security/cve?package=qtwebkit-source","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qtwebkit-source","debian":"https://tracker.debian.org/pkg/qtwebkit-source","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"webkit2gtk","source":"https://ubuntu.com/security/cve?package=webkit2gtk","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=webkit2gtk","debian":"https://tracker.debian.org/pkg/webkit2gtk","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support, was deferred","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was deferred","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.42.1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"2.42.1-0ubuntu0.22.04.1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"2.42.1-0ubuntu0.23.04.1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"2.42.1-2","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"2.42.1-2","component":null,"pocket":"security"}]},{"name":"webkitgtk","source":"https://ubuntu.com/security/cve?package=webkitgtk","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=webkitgtk","debian":"https://tracker.debian.org/pkg/webkitgtk","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-6426-1"],"notices":[{"id":"USN-6426-1","title":"WebKitGTK vulnerabilities","summary":"Several security issues were fixed in WebKitGTK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any applications\nthat use WebKitGTK, such as Epiphany, to make all the necessary changes.\n","references":[],"published":"2023-10-10T15:09:00.220217","description":"Several security issues were discovered in the WebKitGTK Web and JavaScript\nengines. If a user were tricked into viewing a malicious website, a remote\nattacker could exploit a variety of issues related to web browser security,\nincluding cross-site scripting attacks, denial of service attacks, and\narbitrary code execution.\n","is_hidden":false,"release_packages":{"jammy":[{"name":"webkit2gtk","version":"2.42.1-0ubuntu0.22.04.1","description":"Web content engine library for GTK+","is_source":true},{"name":"gir1.2-javascriptcoregtk-4.0","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"gir1.2-javascriptcoregtk-4.1","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"gir1.2-javascriptcoregtk-6.0","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"gir1.2-webkit-6.0","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"gir1.2-webkit2-4.0","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"gir1.2-webkit2-4.1","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.0-18","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.0-bin","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.0-dev","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.1-0","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.1-dev","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-6.0-1","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-6.0-dev","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.0-37","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.0-dev","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.0-doc","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.1-0","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.1-dev","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libwebkitgtk-6.0-4","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"libwebkitgtk-6.0-dev","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"},{"name":"webkit2gtk-driver","version":"2.42.1-0ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.22.04.1","pocket":"security"}],"lunar":[{"name":"webkit2gtk","version":"2.42.1-0ubuntu0.23.04.1","description":"Web content engine library for GTK+","is_source":true},{"name":"gir1.2-javascriptcoregtk-4.0","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"gir1.2-javascriptcoregtk-4.1","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"gir1.2-javascriptcoregtk-6.0","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"gir1.2-webkit-6.0","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"gir1.2-webkit2-4.0","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"gir1.2-webkit2-4.1","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.0-18","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.0-bin","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.0-dev","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.1-0","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-4.1-dev","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-6.0-1","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libjavascriptcoregtk-6.0-dev","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.0-37","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.0-dev","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.0-doc","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.1-0","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libwebkit2gtk-4.1-dev","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libwebkitgtk-6.0-4","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"libwebkitgtk-6.0-dev","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"},{"name":"webkit2gtk-driver","version":"2.42.1-0ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/webkit2gtk","version_link":"https://launchpad.net/ubuntu/+source/webkit2gtk/2.42.1-0ubuntu0.23.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2023-41993","CVE-2023-39928","CVE-2023-41074"]}]},{"id":"CVE-2023-42805","published":"2023-09-21T17:15:00","updated_at":"2025-07-11T07:55:56.798631+00:00","description":"\nquinn-proto is a state machine for the QUIC transport protocol. Prior to\nversions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet\ncould result in a panic. The problem has been fixed in 0.9.5 and 0.10.5\nmaintenance releases.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/quinn-rs/quinn/pull/1667","https://github.com/quinn-rs/quinn/pull/1668","https://github.com/quinn-rs/quinn/pull/1669","https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3","https://rustsec.org/advisories/RUSTSEC-2023-0063.html","https://www.cve.org/CVERecord?id=CVE-2023-42805"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1052546"],"patches":{"rust-quinn-proto":[]},"tags":{},"packages":[{"name":"rust-quinn-proto","source":"https://ubuntu.com/security/cve?package=rust-quinn-proto","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-quinn-proto","debian":"https://tracker.debian.org/pkg/rust-quinn-proto","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-42456","published":"2023-09-21T16:15:00","updated_at":"2025-08-04T19:47:13.759081+00:00","description":"\nSudo-rs, a memory safe implementation of sudo and su, allows users to not\nhave to enter authentication at every sudo attempt, but instead only\nrequiring authentication every once in a while in every terminal or process\ngroup. Only once a configurable timeout has passed will the user have to\nre-authenticate themselves. Supporting this functionality is a set of\nsession files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`.\nThese files are named according to the username from which the sudo attempt\nis made (the origin user).\nAn issue was discovered in versions prior to 0.2.1 where usernames\ncontaining the `.` and `/` characters could result in the corruption of\nspecific files on the filesystem. As usernames are generally not limited by\nthe characters they can contain, a username appearing to be a relative path\ncan be constructed. For example we could add a user to the system\ncontaining the username `../../../../bin/cp`. When logged in as a user with\nthat name, that user could run `sudo -K` to clear their session record\nfile. The session code then constructs the path to the session file by\nconcatenating the username to the session file storage directory, resulting\nin a resolved path of `/bin/cp`. The code then clears that file, resulting\nin the `cp` binary effectively being removed from the system.\nAn attacker needs to be able to login as a user with a constructed\nusername. Given that such a username is unlikely to exist on an existing\nsystem, they will also need to be able to create the users with the\nconstructed usernames.\nThe issue is patched in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid\nfor the user instead of their username for determining the filename. Note\nthat an upgrade to this version will result in existing session files being\nignored and users will be forced to re-authenticate. It also fully\neliminates any possibility of path traversal, given that uids are always\ninteger values.\nThe `sudo -K` and `sudo -k` commands can run, even if a user has no sudo\naccess. As a workaround, make sure that one's system does not contain any\nusers with a specially crafted username. While this is the case and while\nuntrusted users do not have the ability to create arbitrary users on the\nsystem, one should not be able to exploit this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/memorysafety/sudo-rs/security/advisories/GHSA-2r3c-m6v7-9354","https://www.cve.org/CVERecord?id=CVE-2023-42456"],"bugs":[""],"patches":{"rust-sudo-rs":["upstream: https://github.com/memorysafety/sudo-rs/commit/bfdbda22968e3de43fa8246cab1681cfd5d5493d"]},"tags":{},"packages":[{"name":"rust-sudo-rs","source":"https://ubuntu.com/security/cve?package=rust-sudo-rs","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-sudo-rs","debian":"https://tracker.debian.org/pkg/rust-sudo-rs","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43669","published":"2023-09-21T06:15:00","updated_at":"2025-07-11T07:56:00.540720+00:00","description":"\nThe Tungstenite crate before 0.20.1 for Rust allows remote attackers to\ncause a denial of service (minutes of CPU consumption) via an excessive\nlength of an HTTP header in a client handshake. The length affects both how\nmany times a parse is attempted (e.g., thousands of times) and the average\namount of data for each parse attempt (e.g., millions of bytes).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/snapview/tungstenite-rs/issues/376","https://github.com/snapview/tungstenite-rs/commit/f916b332a97f78f4d54d942b9e008a1af57ff938 (v0.20.1)","https://github.com/snapview/tungstenite-rs/commit/2e5029284b8bef3e59df0c9d3920c0ed6c7da7a9 (v0.20.1)","https://github.com/snapview/tungstenite-rs/commit/8b3ecd3cc0008145ab4bc8d0657c39d09db8c7e2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THK6G6CD4VW6RCROWUV2C4HSINKK3XAK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R77EUWPZVP5WSMNXUXUDNHR7G7OI5NGM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TT7SF6CQ5VHAGFLWNXY64NFSW4WIWE7D/","https://bugzilla.redhat.com/show_bug.cgi?id=2240110","https://bugzilla.suse.com/show_bug.cgi?id=1215563","https://crates.io/crates/tungstenite/versions","https://cwe.mitre.org/data/definitions/407.html","https://github.com/advisories/GHSA-9mcr-873m-xcxp","https://github.com/github/advisory-database/pull/2752","https://security-tracker.debian.org/tracker/CVE-2023-43669","https://www.cve.org/CVERecord?id=CVE-2023-43669"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1052415"],"patches":{"rust-tungstenite":[]},"tags":{},"packages":[{"name":"rust-tungstenite","source":"https://ubuntu.com/security/cve?package=rust-tungstenite","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-tungstenite","debian":"https://tracker.debian.org/pkg/rust-tungstenite","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8371","published":"2023-09-21T06:15:00","updated_at":"2025-08-25T21:47:23.162008+00:00","description":"\nComposer before 2016-02-10 allows cache poisoning from other projects built\non the same host. This results in attacker-controlled code entering a\nserver-side build process. The issue occurs because of the way that dist\npackages are cached. The cache key is derived from the package name, the\ndist type, and certain other data from the package repository (which may\nsimply be a commit hash, and thus can be found by an attacker). Versions\nthrough 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.","ubuntu_description":"","notes":[{"author":"tyhicks","note":"Fixed in 10.02.2016 upstream"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html","https://www.cve.org/CVERecord?id=CVE-2015-8371"],"bugs":[""],"patches":{"composer":[]},"tags":{},"packages":[{"name":"composer","source":"https://ubuntu.com/security/cve?package=composer","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=composer","debian":"https://tracker.debian.org/pkg/composer","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"1.0.0~beta2-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.0~alpha11-3","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.0.0~beta2-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-36109","published":"2023-09-20T22:15:00","updated_at":"2025-08-26T18:49:04.869758+00:00","description":"\nBuffer Overflow vulnerability in JerryScript version 3.0, allows remote\nattackers to execute arbitrary code via ecma_stringbuilder_append_raw\ncomponent at /jerry-core/ecma/base/ecma-helpers-string.c.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/jerryscript-project/jerryscript/issues/5080","https://github.com/Limesss/CVE-2023-36109/tree/main","https://www.cve.org/CVERecord?id=CVE-2023-36109"],"bugs":[""],"patches":{"iotjs":[]},"tags":{},"packages":[{"name":"iotjs","source":"https://ubuntu.com/security/cve?package=iotjs","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=iotjs","debian":"https://tracker.debian.org/pkg/iotjs","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43377","published":"2023-09-20T19:15:00","updated_at":"2025-07-11T07:55:58.595018+00:00","description":"\nA cross-site scripting (XSS) vulnerability in\n/hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers\nto execute arbitrary web scripts or HTML via a crafted payload injected\ninto the destinatario_email1 parameter.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-hoteldruid-version-3-0-5-via-destinatario_email1-post-parameter-0ac6596d5b534dd1b2a49987ad065d1c?pvs=4","https://www.cve.org/CVERecord?id=CVE-2023-43377"],"bugs":[""],"patches":{"hoteldruid":[]},"tags":{},"packages":[{"name":"hoteldruid","source":"https://ubuntu.com/security/cve?package=hoteldruid","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=hoteldruid","debian":"https://tracker.debian.org/pkg/hoteldruid","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43376","published":"2023-09-20T19:15:00","updated_at":"2025-07-11T07:55:58.595018+00:00","description":"\nA cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of\nHoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML\nvia a crafted payload injected into the nometipotariffa1 parameter.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-hoteldruid-version-3-0-5-via-nometipotariffa1-post-parameter-703fde27462c43a1aaa1097fb3416cdc?pvs=4","https://www.cve.org/CVERecord?id=CVE-2023-43376"],"bugs":[""],"patches":{"hoteldruid":[]},"tags":{},"packages":[{"name":"hoteldruid","source":"https://ubuntu.com/security/cve?package=hoteldruid","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=hoteldruid","debian":"https://tracker.debian.org/pkg/hoteldruid","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43375","published":"2023-09-20T19:15:00","updated_at":"2025-07-11T07:55:58.595018+00:00","description":"\nHoteldruid v3.0.5 was discovered to contain multiple SQL injection\nvulnerabilities at /hoteldruid/clienti.php via the annonascita,\nannoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, and\nmesescaddoc parameters.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-hoteldruid-version-3-0-5-via-multiple-post-parameter-ddbd9a9011744ed2b8fc995bbc9de56d?pvs=4","https://www.cve.org/CVERecord?id=CVE-2023-43375"],"bugs":[""],"patches":{"hoteldruid":[]},"tags":{},"packages":[{"name":"hoteldruid","source":"https://ubuntu.com/security/cve?package=hoteldruid","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=hoteldruid","debian":"https://tracker.debian.org/pkg/hoteldruid","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43374","published":"2023-09-20T19:15:00","updated_at":"2025-07-11T07:55:58.595018+00:00","description":"\nHoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability\nvia the id_utente_log parameter at /hoteldruid/personalizza.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-id_utente_log-parameter-8b89f014004947e7bd2ecdacf1610cf9?pvs=4","https://www.cve.org/CVERecord?id=CVE-2023-43374"],"bugs":[""],"patches":{"hoteldruid":[]},"tags":{},"packages":[{"name":"hoteldruid","source":"https://ubuntu.com/security/cve?package=hoteldruid","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=hoteldruid","debian":"https://tracker.debian.org/pkg/hoteldruid","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43373","published":"2023-09-20T19:15:00","updated_at":"2025-07-11T07:55:58.595018+00:00","description":"\nHoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability\nvia the n_utente_agg parameter at /hoteldruid/interconnessioni.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-n_utente_agg-parameter-948a6d724b5348f3867ee6d780f98f1a?pvs=4","https://www.cve.org/CVERecord?id=CVE-2023-43373"],"bugs":[""],"patches":{"hoteldruid":[]},"tags":{},"packages":[{"name":"hoteldruid","source":"https://ubuntu.com/security/cve?package=hoteldruid","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=hoteldruid","debian":"https://tracker.debian.org/pkg/hoteldruid","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-43371","published":"2023-09-20T19:15:00","updated_at":"2025-07-11T07:55:58.595018+00:00","description":"\nHoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability\nvia the numcaselle parameter at /hoteldruid/creaprezzi.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-numcaselle-parameter-e1e3d6938a464a8db1ca18ee66b7e66e?pvs=4","https://www.cve.org/CVERecord?id=CVE-2023-43371"],"bugs":[""],"patches":{"hoteldruid":[]},"tags":{},"packages":[{"name":"hoteldruid","source":"https://ubuntu.com/security/cve?package=hoteldruid","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=hoteldruid","debian":"https://tracker.debian.org/pkg/hoteldruid","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-40619","published":"2023-09-20T18:15:00","updated_at":"2025-07-11T07:55:52.097333+00:00","description":"\nphpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted\ndata which may lead to remote code execution because user-controlled data\nis directly passed to the PHP 'unserialize()' function in multiple places.\nAn example is the functionality to manage tables in 'tables.php' where the\n'ma[]' POST parameter is deserialized.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-40619","https://www.cve.org/CVERecord?id=CVE-2023-40619"],"bugs":[""],"patches":{"phppgadmin":[]},"tags":{},"packages":[{"name":"phppgadmin","source":"https://ubuntu.com/security/cve?package=phppgadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phppgadmin","debian":"https://tracker.debian.org/pkg/phppgadmin","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2019-19450","published":"2023-09-20T14:15:00","updated_at":"2025-08-26T12:14:57.942876+00:00","description":"\nparaparser in ReportLab before 3.5.31 allows remote code execution because\nstart_unichar in paraparser.py evaluates untrusted user input in a unichar\nelement in a crafted XML document with '<unichar code=\"' followed by\narbitrary Python code, a similar issue to CVE-2019-17626.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md","https://pastebin.com/5MicRrr4","https://www.cve.org/CVERecord?id=CVE-2019-19450"],"bugs":[""],"patches":{"python-reportlab":[]},"tags":{},"packages":[{"name":"python-reportlab","source":"https://ubuntu.com/security/cve?package=python-reportlab","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-reportlab","debian":"https://tracker.debian.org/pkg/python-reportlab","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"3.5.34-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"3.6.8-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"3.6.12-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.5.31","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4.0.4-11","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4.0.4-11","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4.0.4-11","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4.0.4-11","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4.0.4-11","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4.0.4-11","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-4504","published":"2023-09-20T12:00:00","updated_at":"2025-08-19T22:09:43.518215+00:00","description":"\nDue to failure in validating the length provided by an attacker-crafted PPD\nPostScript document, CUPS and libppd are susceptible to a heap-based buffer\noverflow and possibly code execution. This issue has been fixed in CUPS\nversion 2.4.7, released in September of 2023.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":0.0,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":0.0,"baseSeverity":"NONE"}}},"status":"active","mitigation":"","references":["https://takeonme.org/cves/CVE-2023-4504.html","https://ubuntu.com/security/notices/USN-6391-1","https://ubuntu.com/security/notices/USN-6392-1","https://ubuntu.com/security/notices/USN-6391-2","https://www.cve.org/CVERecord?id=CVE-2023-4504"],"bugs":[""],"patches":{"cups":[],"libppd":[]},"tags":{},"packages":[{"name":"libppd","source":"https://ubuntu.com/security/cve?package=libppd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libppd","debian":"https://tracker.debian.org/pkg/libppd","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"2:2.0~rc1-0ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"released","description":"2:2.0~rc1-0ubuntu4","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"2:2.0~rc1-0ubuntu4","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"2:2.0~rc1-0ubuntu4","component":null,"pocket":"security"},{"release_codename":"plucky","status":"released","description":"2:2.0~rc1-0ubuntu4","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"released","description":"2:2.0~rc1-0ubuntu4","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"2:2.0~rc1-0ubuntu4","component":null,"pocket":"security"}]},{"name":"cups","source":"https://ubuntu.com/security/cve?package=cups","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=cups","debian":"https://tracker.debian.org/pkg/cups","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"2.3.1-9ubuntu1.6","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"2.4.1op1-1ubuntu4.7","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"2.4.2-3ubuntu2.5","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"2.2.7-1ubuntu2.10+esm2","component":null,"pocket":"esm-infra"},{"release_codename":"xenial","status":"released","description":"2.1.3-4ubuntu0.11+esm4","component":null,"pocket":"esm-infra"},{"release_codename":"mantic","status":"released","description":"2.4.6-0ubuntu2","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"2.4.6-0ubuntu2","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"2.4.6-0ubuntu2","component":null,"pocket":"security"},{"release_codename":"plucky","status":"released","description":"2.4.6-0ubuntu2","component":null,"pocket":"security"},{"release_codename":"resolute","status":"released","description":"2.4.6-0ubuntu2","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"2.4.6-0ubuntu2","component":null,"pocket":"security"}]}],"notices_ids":["USN-6391-1","USN-6392-1","USN-6391-2"],"notices":[{"id":"USN-6391-1","title":"CUPS vulnerability","summary":"CUPS could be made to crash or run programs if it opened a specially\ncrafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-09-20T14:17:48.150189","description":"It was discovered that CUPS incorrectly parsed certain Postscript objects.\nIf a user or automated system were tricked into printing a specially\ncrafted document, a remote attacker could use this issue to cause CUPS to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","is_hidden":false,"release_packages":{"focal":[{"name":"cups","version":"2.3.1-9ubuntu1.6","description":"Common UNIX Printing System(tm)","is_source":true},{"name":"cups","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-bsd","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-client","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-common","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-core-drivers","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-daemon","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-ipp-utils","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-ppdc","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"cups-server-common","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"libcups2","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"libcups2-dev","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"libcupsimage2","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"},{"name":"libcupsimage2-dev","version":"2.3.1-9ubuntu1.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.3.1-9ubuntu1.6","pocket":"security"}],"jammy":[{"name":"cups","version":"2.4.1op1-1ubuntu4.7","description":"Common UNIX Printing System(tm)","is_source":true},{"name":"cups","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-bsd","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-client","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-common","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-core-drivers","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-daemon","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-ipp-utils","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-ppdc","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"cups-server-common","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"libcups2","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"libcups2-dev","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"libcupsimage2","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"},{"name":"libcupsimage2-dev","version":"2.4.1op1-1ubuntu4.7","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.1op1-1ubuntu4.7","pocket":"security"}],"lunar":[{"name":"cups","version":"2.4.2-3ubuntu2.5","description":"Common UNIX Printing System(tm)","is_source":true},{"name":"cups","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-bsd","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-client","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-common","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-core-drivers","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-daemon","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-ipp-utils","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-ppdc","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"cups-server-common","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"libcups2","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"libcups2-dev","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"libcupsimage2","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"},{"name":"libcupsimage2-dev","version":"2.4.2-3ubuntu2.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":"https://launchpad.net/ubuntu/+source/cups/2.4.2-3ubuntu2.5","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2023-4504"]},{"id":"USN-6392-1","title":"libppd vulnerability","summary":"libppd could be made to crash or run programs if it opened a specially\ncrafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-09-20T14:22:33.044698","description":"It was discovered that libppd incorrectly parsed certain Postscript\nobjects. If a user or automated system were tricked into printing a\nspecially crafted document, a remote attacker could use this issue to cause\nlibppd to crash, resulting in a denial of service, or possibly execute\narbitrary code.\n","is_hidden":false,"release_packages":{"lunar":[{"name":"libppd","version":"2:2.0~rc1-0ubuntu1.2","description":"OpenPrinting libppd","is_source":true},{"name":"libppd-dev","version":"2:2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libppd","version_link":"https://launchpad.net/ubuntu/+source/libppd/2:2.0~rc1-0ubuntu1.2","pocket":"security"},{"name":"libppd-tests","version":"2:2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libppd","version_link":"https://launchpad.net/ubuntu/+source/libppd/2:2.0~rc1-0ubuntu1.2","pocket":"security"},{"name":"libppd-utils","version":"2:2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libppd","version_link":"https://launchpad.net/ubuntu/+source/libppd/2:2.0~rc1-0ubuntu1.2","pocket":"security"},{"name":"libppd2","version":"2:2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libppd","version_link":"https://launchpad.net/ubuntu/+source/libppd/2:2.0~rc1-0ubuntu1.2","pocket":"security"},{"name":"libppd2-common","version":"2:2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libppd","version_link":"https://launchpad.net/ubuntu/+source/libppd/2:2.0~rc1-0ubuntu1.2","pocket":"security"},{"name":"ppdc","version":"2:2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libppd","version_link":"https://launchpad.net/ubuntu/+source/libppd/2:2.0~rc1-0ubuntu1.2","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2023-4504"]},{"id":"USN-6391-2","title":"CUPS vulnerability","summary":"CUPS could be made to crash or run programs if it opened a specially\ncrafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-09-21T14:09:04.761073","description":"USN-6391-1 fixed a vulnerability in CUPS. This update provides\nthe corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that CUPS incorrectly parsed certain Postscript objects.\n If a user or automated system were tricked into printing a specially\n crafted document, a remote attacker could use this issue to cause CUPS to\n crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","is_hidden":false,"release_packages":{"bionic":[{"name":"cups","version":"2.2.7-1ubuntu2.10+esm2","description":"Common UNIX Printing System(tm)","is_source":true},{"name":"cups","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-bsd","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-client","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-common","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-core-drivers","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-daemon","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-ipp-utils","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-ppdc","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-server-common","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcups2","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcups2-dev","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupscgi1","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsimage2","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsimage2-dev","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsmime1","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsppdc1","version":"2.2.7-1ubuntu2.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"cups","version":"2.1.3-4ubuntu0.11+esm4","description":"Common UNIX Printing System(tm)","is_source":true},{"name":"cups","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-bsd","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-client","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-common","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-core-drivers","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-daemon","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-ipp-utils","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-ppdc","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"cups-server-common","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcups2","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcups2-dev","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupscgi1","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupscgi1-dev","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsimage2","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsimage2-dev","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsmime1","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsmime1-dev","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsppdc1","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"},{"name":"libcupsppdc1-dev","version":"2.1.3-4ubuntu0.11+esm4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2023-4504"]}]},{"id":"CVE-2023-26144","published":"2023-09-20T05:15:00","updated_at":"2025-08-04T18:50:31.083229+00:00","description":"\nVersions of the package graphql from 16.3.0 and before 16.8.1 are\nvulnerable to Denial of Service (DoS) due to insufficient checks in the\nOverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This\nvulnerability allows an attacker to degrade system performance.  **Note:**\nIt was not proven that this vulnerability can crash the process.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226","https://github.com/graphql/graphql-js/pull/3972","https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181","https://github.com/graphql/graphql-js/issues/3955","https://github.com/graphql/graphql-js/releases/tag/v16.8.1","https://www.cve.org/CVERecord?id=CVE-2023-26144"],"bugs":[""],"patches":{"node-graphql":[]},"tags":{},"packages":[{"name":"node-graphql","source":"https://ubuntu.com/security/cve?package=node-graphql","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-graphql","debian":"https://tracker.debian.org/pkg/node-graphql","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":33400,"limit":20,"total_results":79316}