{"cves":[{"id":"CVE-2023-2203","published":"2023-05-17T22:15:00","updated_at":"2025-08-26T00:08:18.197591+00:00","description":"\nA flaw was found in the WebKitGTK package. An improper input validation\nissue may lead to a use-after-free vulnerability. This flaw allows\nattackers with network access to pass specially crafted web content files,\ncausing a denial of service or arbitrary code execution. This CVE exists\nbecause of a CVE-2023-28205 security regression for the WebKitGTK package\nin Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"webkit receives limited support. For details, see\nhttps://wiki.ubuntu.com/SecurityTeam/FAQ#webkit\nwebkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8"},{"author":"mdeslaur","note":"This CVE is specific to Red Hat's webkitgtk package, Ubuntu is\nnot vulnerable to this issue."}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2023-2203"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=2188543"],"patches":{"webkitgtk":[],"webkit2gtk":[],"qtwebkit-source":[],"qtwebkit-opensource-src":[],"wpewebkit":[]},"tags":{},"packages":[{"name":"wpewebkit","source":"https://ubuntu.com/security/cve?package=wpewebkit","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=wpewebkit","debian":"https://tracker.debian.org/pkg/wpewebkit","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"qtwebkit-opensource-src","source":"https://ubuntu.com/security/cve?package=qtwebkit-opensource-src","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qtwebkit-opensource-src","debian":"https://tracker.debian.org/pkg/qtwebkit-opensource-src","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"qtwebkit-source","source":"https://ubuntu.com/security/cve?package=qtwebkit-source","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qtwebkit-source","debian":"https://tracker.debian.org/pkg/qtwebkit-source","statuses":[{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"webkit2gtk","source":"https://ubuntu.com/security/cve?package=webkit2gtk","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=webkit2gtk","debian":"https://tracker.debian.org/pkg/webkit2gtk","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"debian: RHEL-specific backport regression","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was deferred","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support, was deferred","component":null,"pocket":"security"}]},{"name":"webkitgtk","source":"https://ubuntu.com/security/cve?package=webkitgtk","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=webkitgtk","debian":"https://tracker.debian.org/pkg/webkitgtk","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-26044","published":"2023-05-17T18:15:00","updated_at":"2026-02-09T05:51:21.041577+00:00","description":"\nreact/http is an event-driven, streaming HTTP client and server\nimplementation for ReactPHP.  Previous versions of ReactPHP's HTTP server\ncomponent contain a potential DoS vulnerability that can cause high CPU\nload when processing large HTTP request bodies. This vulnerability has\nlittle to no impact on the default configuration, but can be exploited when\nexplicitly using the RequestBodyBufferMiddleware with very large settings.\nThis might lead to consuming large amounts of CPU time for processing\nrequests and significantly delay or slow down the processing of legitimate\nuser requests. This issue has been addressed in release 1.9.0. Users are\nadvised to upgrade. Users unable to upgrade may keep the request body\nlimited using RequestBodyBufferMiddleware with a sensible value which\nshould mitigate the issue. An infrastructure or DevOps workaround could be\nto place a reverse proxy in front of the ReactPHP HTTP server to filter out\nany excessive HTTP request bodies.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/reactphp/http/security/advisories/GHSA-95x4-j7vc-h8mf","https://github.com/reactphp/http/commit/b3594f7936b92f9fc2d5f9e84dc01bdb95a72167 (v1.9.0)","https://github.com/reactphp/http/commit/9681f764b80c45ebfb5fe2ea7da5bd3babfcdcfd","https://www.cve.org/CVERecord?id=CVE-2023-26044"],"bugs":[""],"patches":{"php-react-http":["upstream: https://github.com/reactphp/http/commit/b3594f7936b92f9fc2d5f9e84dc01bdb95a72167","upstream: https://github.com/reactphp/http/commit/9681f764b80c45ebfb5fe2ea7da5bd3babfcdcfd"]},"tags":{},"packages":[{"name":"php-react-http","source":"https://ubuntu.com/security/cve?package=php-react-http","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=php-react-http","debian":"https://tracker.debian.org/pkg/php-react-http","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.0","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-22348","published":"2023-05-17T16:15:00","updated_at":"2025-08-26T18:00:49.174200+00:00","description":"\nImproper Authorization in RestAPI in Checkmk GmbH's Checkmk versions\n<2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary\nhost_configs.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":4.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2023-22348"],"bugs":[""],"patches":{"check-mk":[]},"tags":{},"packages":[{"name":"check-mk","source":"https://ubuntu.com/security/cve?package=check-mk","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=check-mk","debian":"https://tracker.debian.org/pkg/check-mk","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-31725","published":"2023-05-17T15:15:00","updated_at":"2025-07-11T07:54:42.365078+00:00","description":"\nyasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via\nthe function expand_mmac_params at yasm/modules/preprocs/nasm/nasm-pp.c.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/yasm/yasm/issues/221","https://github.com/DaisyPo/fuzzing-vulncollect/tree/main/yasm/heap-use-after-free/nasm-pp.c:3878%20in%20expand_mmac_params","https://www.cve.org/CVERecord?id=CVE-2023-31725"],"bugs":[""],"patches":{"yasm":[]},"tags":{},"packages":[{"name":"yasm","source":"https://ubuntu.com/security/cve?package=yasm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=yasm","debian":"https://tracker.debian.org/pkg/yasm","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-31724","published":"2023-05-17T15:15:00","updated_at":"2025-07-11T07:54:42.365078+00:00","description":"\nyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via\nthe function do_directive at /nasm/nasm-pp.c.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/yasm/yasm/issues/222","https://github.com/DaisyPo/fuzzing-vulncollect/tree/main/yasm/SEGV/nasm-pp.c:3570%20in%20do_directive","https://www.cve.org/CVERecord?id=CVE-2023-31724"],"bugs":[""],"patches":{"yasm":[]},"tags":{},"packages":[{"name":"yasm","source":"https://ubuntu.com/security/cve?package=yasm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=yasm","debian":"https://tracker.debian.org/pkg/yasm","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-31723","published":"2023-05-17T15:15:00","updated_at":"2025-07-11T07:54:42.365078+00:00","description":"\nyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via\nthe function expand_mmac_params at /nasm/nasm-pp.c.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/DaisyPo/fuzzing-vulncollect/blob/main/yasm/SEGV/nasm-pp.c:4008%20in%20expand_mmac_params/README.md","https://github.com/yasm/yasm/issues/220","https://www.cve.org/CVERecord?id=CVE-2023-31723"],"bugs":[""],"patches":{"yasm":[]},"tags":{},"packages":[{"name":"yasm","source":"https://ubuntu.com/security/cve?package=yasm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=yasm","debian":"https://tracker.debian.org/pkg/yasm","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-31722","published":"2023-05-17T14:15:00","updated_at":"2026-05-13T13:34:37.299426+00:00","description":"\nThere exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit:\nb952891).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://bugzilla.nasm.us/show_bug.cgi?id=3392857#c1","https://www.cve.org/CVERecord?id=CVE-2023-31722","https://ubuntu.com/security/notices/USN-8248-1"],"bugs":[""],"patches":{"nasm":["upstream: https://repo.or.cz/nasm/nasm2.git/commit/e39b856bdeec852e9b078dd9b7cad74caee618b4"]},"tags":{},"packages":[{"name":"nasm","source":"https://ubuntu.com/security/cve?package=nasm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=nasm","debian":"https://tracker.debian.org/pkg/nasm","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"3.01-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was deferred [2025-09-11]","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"2.16.01-1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"jammy","status":"released","description":"2.15.05-1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"}]}],"notices_ids":["USN-8248-1"],"notices":[{"id":"USN-8248-1","title":"NASM vulnerabilities","summary":"Several security issues were fixed in NASM.","instructions":"In general, a standard system update will make all the necessary\nchanges.","references":[],"published":"2026-05-07T13:00:13.762448","description":"Daisy Chen discovered that NASM was vulnerable to a heap buffer overflow\nwhen handling certain input. An attacker could possibly use this issue\nto cause NASM to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2023-31722)\n\nIt was discovered that NASM incorrectly handled memory allocation.\nAn attacker could possibly use this issue to cause NASM to use\nexcessive resources, leading to a denial of service. This issue\nonly affected Ubuntu 24.04 LTS. (CVE-2021-33452, CVE-2021-33450)","is_hidden":false,"release_packages":{"jammy":[{"name":"nasm","version":"2.15.05-1ubuntu0.1~esm1","description":"Netwide Assembler","is_source":true},{"name":"nasm","version":"2.15.05-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/nasm","version_link":null,"pocket":"esm-apps"}],"noble":[{"name":"nasm","version":"2.16.01-1ubuntu0.1~esm1","description":"Netwide Assembler","is_source":true},{"name":"nasm","version":"2.16.01-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/nasm","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2021-33450","CVE-2021-33452","CVE-2023-31722"]}]},{"id":"CVE-2023-31208","published":"2023-05-17T09:15:00","updated_at":"2025-08-26T17:30:42.131611+00:00","description":"\nImproper neutralization of livestatus command delimiters in the RestAPI in\nCheckmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary\nlivestatus command execution for authorized users.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2023-31208"],"bugs":[""],"patches":{"check-mk":[]},"tags":{},"packages":[{"name":"check-mk","source":"https://ubuntu.com/security/cve?package=check-mk","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=check-mk","debian":"https://tracker.debian.org/pkg/check-mk","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-2745","published":"2023-05-17T09:15:00","updated_at":"2025-08-26T17:55:01.509607+00:00","description":"\nWordPress Core is vulnerable to Directory Traversal in versions up to, and\nincluding, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated\nattackers to access and load arbitrary translation files. In cases where an\nattacker is able to upload a crafted translation file onto the site, such\nas via an upload form, this could be also used to perform a Cross-Site\nScripting attack.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://core.trac.wordpress.org/changeset?old=55765&new=55765","https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/","https://www.cve.org/CVERecord?id=CVE-2023-2745"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036296"],"patches":{"wordpress":[]},"tags":{},"packages":[{"name":"wordpress","source":"https://ubuntu.com/security/cve?package=wordpress","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=wordpress","debian":"https://tracker.debian.org/pkg/wordpress","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"6.2.1+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"6.4.3+dfsg1-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"6.4.3+dfsg1-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"6.4.3+dfsg1-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"6.4.3+dfsg1-1ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-28322","published":"2023-05-17T06:00:00","updated_at":"2025-08-18T17:21:41.482928+00:00","description":"\nAn information disclosure vulnerability exists in curl <v8.1.0 when doing\nHTTP(S) transfers, libcurl might erroneously use the read callback\n(`CURLOPT_READFUNCTION`) to ask for data to send, even when the\n`CURLOPT_POSTFIELDS` option has been set, if the same handle previously\nwasused to issue a `PUT` request which used that callback. This flaw may\nsurprise the application and cause it to misbehave and either send off the\nwrong data or use memory after free or similar in the second transfer. The\nproblem exists in the logic for a reused handle when it is (expected to be)\nchanged from a PUT to a POST.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://curl.se/docs/CVE-2023-28322.html","https://ubuntu.com/security/notices/USN-6237-1","https://ubuntu.com/security/notices/USN-6237-3","https://www.cve.org/CVERecord?id=CVE-2023-28322"],"bugs":[""],"patches":{"curl":["upstream: https://github.com/curl/curl/commit/7815647d6582c0a4900be2e1de"]},"tags":{},"packages":[{"name":"curl","source":"https://ubuntu.com/security/cve?package=curl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=curl","debian":"https://tracker.debian.org/pkg/curl","statuses":[{"release_codename":"upstream","status":"released","description":"8.1.0","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"7.68.0-1ubuntu2.19","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"7.81.0-1ubuntu1.11","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"7.85.0-1ubuntu0.6","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"7.88.1-8ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"7.58.0-2ubuntu3.24+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"trusty","status":"released","description":"7.35.0-1ubuntu2.20+esm16","component":null,"pocket":"esm-infra"},{"release_codename":"xenial","status":"released","description":"7.47.0-1ubuntu2.19+esm9","component":null,"pocket":"esm-infra"},{"release_codename":"mantic","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-6237-1","USN-6237-3"],"notices":[{"id":"USN-6237-1","title":"curl vulnerabilities","summary":"Several security issues were fixed in curl.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-07-19T12:11:55.723501","description":"Hiroki Kurosawa discovered that curl incorrectly handled validating certain\ncertificate wildcards. A remote attacker could possibly use this issue to\nspoof certain website certificates using IDN hosts. (CVE-2023-28321)\n\nHiroki Kurosawa discovered that curl incorrectly handled callbacks when\ncertain options are set by applications. This could cause applications\nusing curl to misbehave, resulting in information disclosure, or a denial\nof service. (CVE-2023-28322)\n\nIt was discovered that curl incorrectly handled saving cookies to files. A\nlocal attacker could possibly use this issue to create or overwrite files.\nThis issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)\n","is_hidden":false,"release_packages":{"kinetic":[{"name":"curl","version":"7.85.0-1ubuntu0.6","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4-doc","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl3-nss","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"curl","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"}],"jammy":[{"name":"curl","version":"7.81.0-1ubuntu1.11","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4-doc","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl3-nss","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"curl","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"}],"lunar":[{"name":"curl","version":"7.88.1-8ubuntu2.1","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4-doc","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl3-nss","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"curl","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"}],"focal":[{"name":"curl","version":"7.68.0-1ubuntu2.19","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4-doc","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl3-nss","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"curl","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2023-28321","CVE-2023-28322","CVE-2023-32001"]},{"id":"USN-6237-3","title":"curl vulnerabilities","summary":"Several security issues were fixed in curl.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-09-11T18:00:42.985355","description":"USN-6237-1 fixed several vulnerabilities in curl. This update provides the\ncorresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and\nUbuntu 18.04 LTS.\n\nOriginal advisory details:\n\n Hiroki Kurosawa discovered that curl incorrectly handled validating certain\n certificate wildcards. A remote attacker could possibly use this issue to\n spoof certain website certificates using IDN hosts. (CVE-2023-28321)\n \n Hiroki Kurosawa discovered that curl incorrectly handled callbacks when\n certain options are set by applications. This could cause applications\n using curl to misbehave, resulting in information disclosure, or a denial\n of service. (CVE-2023-28322)\n \n It was discovered that curl incorrectly handled saving cookies to files. A\n local attacker could possibly use this issue to create or overwrite files.\n This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"curl","version":"7.58.0-2ubuntu3.24+esm1","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}],"trusty":[{"name":"curl","version":"7.35.0-1ubuntu2.20+esm16","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"curl","version":"7.47.0-1ubuntu2.19+esm9","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2023-28322","CVE-2023-28321"]}]},{"id":"CVE-2023-28321","published":"2023-05-17T06:00:00","updated_at":"2025-08-18T17:21:41.482928+00:00","description":"\nAn improper certificate validation vulnerability exists in curl <v8.1.0 in\nthe way it supports matching of wildcard patterns when listed as \"Subject\nAlternative Name\" in TLS server certificates. curl can be built to use its\nown name matching function for TLS rather than one provided by a TLS\nlibrary. This private wildcard matching function would match IDN\n(International Domain Name) hosts incorrectly and could as a result accept\npatterns that otherwise should mismatch. IDN hostnames are converted to\npuny code before used for certificate checks. Puny coded names always start\nwith `xn--` and should not be allowed to pattern match, but the wildcard\ncheck in curl could still check for `x*`, which would match even though the\nIDN name most likely contained nothing even resembling an `x`.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.9,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://curl.se/docs/CVE-2023-28321.html","https://ubuntu.com/security/notices/USN-6237-1","https://ubuntu.com/security/notices/USN-6237-3","https://www.cve.org/CVERecord?id=CVE-2023-28321"],"bugs":[""],"patches":{"curl":["upstream: https://github.com/curl/curl/commit/199f2d440d8659b42"]},"tags":{},"packages":[{"name":"curl","source":"https://ubuntu.com/security/cve?package=curl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=curl","debian":"https://tracker.debian.org/pkg/curl","statuses":[{"release_codename":"upstream","status":"released","description":"8.1.0","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"7.68.0-1ubuntu2.19","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"7.81.0-1ubuntu1.11","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"7.85.0-1ubuntu0.6","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"7.88.1-8ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"7.58.0-2ubuntu3.24+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"trusty","status":"released","description":"7.35.0-1ubuntu2.20+esm16","component":null,"pocket":"esm-infra"},{"release_codename":"xenial","status":"released","description":"7.47.0-1ubuntu2.19+esm9","component":null,"pocket":"esm-infra"},{"release_codename":"mantic","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"7.88.1-10ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-6237-1","USN-6237-3"],"notices":[{"id":"USN-6237-1","title":"curl vulnerabilities","summary":"Several security issues were fixed in curl.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-07-19T12:11:55.723501","description":"Hiroki Kurosawa discovered that curl incorrectly handled validating certain\ncertificate wildcards. A remote attacker could possibly use this issue to\nspoof certain website certificates using IDN hosts. (CVE-2023-28321)\n\nHiroki Kurosawa discovered that curl incorrectly handled callbacks when\ncertain options are set by applications. This could cause applications\nusing curl to misbehave, resulting in information disclosure, or a denial\nof service. (CVE-2023-28322)\n\nIt was discovered that curl incorrectly handled saving cookies to files. A\nlocal attacker could possibly use this issue to create or overwrite files.\nThis issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)\n","is_hidden":false,"release_packages":{"kinetic":[{"name":"curl","version":"7.85.0-1ubuntu0.6","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4-doc","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl3-nss","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"libcurl4","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"},{"name":"curl","version":"7.85.0-1ubuntu0.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.6","pocket":"security"}],"jammy":[{"name":"curl","version":"7.81.0-1ubuntu1.11","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4-doc","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl3-nss","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"libcurl4","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"},{"name":"curl","version":"7.81.0-1ubuntu1.11","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.11","pocket":"security"}],"lunar":[{"name":"curl","version":"7.88.1-8ubuntu2.1","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4-doc","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl3-nss","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"libcurl4","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"},{"name":"curl","version":"7.88.1-8ubuntu2.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.88.1-8ubuntu2.1","pocket":"security"}],"focal":[{"name":"curl","version":"7.68.0-1ubuntu2.19","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"libcurl4-gnutls-dev","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4-openssl-dev","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl3-gnutls","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4-doc","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl3-nss","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4-nss-dev","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"libcurl4","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"},{"name":"curl","version":"7.68.0-1ubuntu2.19","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":"https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.19","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2023-28321","CVE-2023-28322","CVE-2023-32001"]},{"id":"USN-6237-3","title":"curl vulnerabilities","summary":"Several security issues were fixed in curl.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-09-11T18:00:42.985355","description":"USN-6237-1 fixed several vulnerabilities in curl. This update provides the\ncorresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and\nUbuntu 18.04 LTS.\n\nOriginal advisory details:\n\n Hiroki Kurosawa discovered that curl incorrectly handled validating certain\n certificate wildcards. A remote attacker could possibly use this issue to\n spoof certain website certificates using IDN hosts. (CVE-2023-28321)\n \n Hiroki Kurosawa discovered that curl incorrectly handled callbacks when\n certain options are set by applications. This could cause applications\n using curl to misbehave, resulting in information disclosure, or a denial\n of service. (CVE-2023-28322)\n \n It was discovered that curl incorrectly handled saving cookies to files. A\n local attacker could possibly use this issue to create or overwrite files.\n This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"curl","version":"7.58.0-2ubuntu3.24+esm1","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.58.0-2ubuntu3.24+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}],"trusty":[{"name":"curl","version":"7.35.0-1ubuntu2.20+esm16","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.35.0-1ubuntu2.20+esm16","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"curl","version":"7.47.0-1ubuntu2.19+esm9","description":"HTTP, HTTPS, and FTP client and client libraries","is_source":true},{"name":"curl","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-gnutls","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl3-nss","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-doc","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-gnutls-dev","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-nss-dev","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"},{"name":"libcurl4-openssl-dev","version":"7.47.0-1ubuntu2.19+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/curl","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2023-28322","CVE-2023-28321"]}]},{"id":"CVE-2023-28320","published":"2023-05-17T06:00:00","updated_at":"2025-08-26T00:10:40.445469+00:00","description":"\nA denial of service vulnerability exists in curl <v8.1.0 in the way libcurl\nprovides several different backends for resolving host names, selected at\nbuild time. If it is built to use the synchronous resolver, it allows name\nresolves to time-out slow operations using `alarm()` and `siglongjmp()`.\nWhen doing this, libcurl used a global buffer that was not mutex protected\nand a multi-threaded application might therefore crash or otherwise\nmisbehave.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"Ubuntu is not vulnerable to this issue as packages are built\nwith the threaded resolver, not the synchronous resolver."}],"codename":null,"priority":"low","cvss3":5.9,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://curl.se/docs/CVE-2023-28320.html","https://www.cve.org/CVERecord?id=CVE-2023-28320"],"bugs":[""],"patches":{"curl":["upstream: https://github.com/curl/curl/commit/13718030ad4b3209a7583b"]},"tags":{},"packages":[{"name":"curl","source":"https://ubuntu.com/security/cve?package=curl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=curl","debian":"https://tracker.debian.org/pkg/curl","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"8.1.0","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-28319","published":"2023-05-17T06:00:00","updated_at":"2025-08-26T00:10:40.445469+00:00","description":"\nA use after free vulnerability exists in curl <v8.1.0 in the way libcurl\noffers a feature to verify an SSH server's public key using a SHA 256 hash.\nWhen this check fails, libcurl would free the memory for the fingerprint\nbefore it returns an error message containing the (now freed) hash. This\nflaw risks inserting sensitive heap-based data into the error message that\nmight be shown to users or otherwise get leaked and revealed.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"introduced in 7.81.0 in\nhttps://github.com/curl/curl/commit/3467e89bb97e6c87c7\n\nThis only affects curl when built with libssh2. Ubuntu packages\ncontain a delta from debian to build with libssh instead of\nlibssh2, so Ubuntu is not affected by this vulnerability."}],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://curl.se/docs/CVE-2023-28319.html","https://www.cve.org/CVERecord?id=CVE-2023-28319"],"bugs":[""],"patches":{"curl":["upstream: https://github.com/curl/curl/commit/8e21b1a05f3c0ee098dbcb6c"]},"tags":{},"packages":[{"name":"curl","source":"https://ubuntu.com/security/cve?package=curl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=curl","debian":"https://tracker.debian.org/pkg/curl","statuses":[{"release_codename":"bionic","status":"not-affected","description":"7.58.0-2ubuntu3.24","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"7.68.0-1ubuntu2.18","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"8.1.0","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"7.81.0-1ubuntu1.20","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2022-42336","published":"2023-05-17T01:15:00","updated_at":"2025-07-11T07:52:57.193677+00:00","description":"\nMishandling of guest SSBD selection on AMD hardware The current logic to\nset SSBD on AMD Family 17h and Hygon Family 18h processors requires that\nthe setting of SSBD is coordinated at a core level, as the setting is\nshared between threads. Logic was introduced to keep track of how many\nthreads require SSBD active in order to coordinate it, such logic relies on\nusing a per-core counter of threads that have SSBD active. When running on\nthe mentioned hardware, it's possible for a guest to under or overflow the\nthread counter, because each write to VIRT_SPEC_CTRL.SSBD by the guest gets\npropagated to the helper that does the per-core active accounting.\nUnderflowing the counter causes the value to get saturated, and thus\nattempts for guests running on the same core to set SSBD won't have effect\nbecause the hypervisor assumes it's already active.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"hypervisor packages are in universe. For\nissues in the hypervisor, add appropriate\ntags to each section, ex:\nTags_xen: universe-binary"}],"codename":null,"priority":"medium","cvss3":3.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2023/05/16/5","https://xenbits.xen.org/xsa/advisory-431.html","https://www.cve.org/CVERecord?id=CVE-2022-42336"],"bugs":[""],"patches":{"xen":[]},"tags":{"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-2731","published":"2023-05-17T00:00:00","updated_at":"2025-08-26T00:10:25.705894+00:00","description":"\nA NULL pointer dereference flaw was found in Libtiff's LZWDecode() function\nin the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft\nspecific input data that can cause the program to dereference a NULL\npointer when decompressing a TIFF format file, resulting in a program crash\nor denial of service.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-6290-1","https://www.cve.org/CVERecord?id=CVE-2023-2731"],"bugs":["https://gitlab.com/libtiff/libtiff/-/issues/548"],"patches":{"tiff":["upstream: https://gitlab.com/libtiff/libtiff/-/commit/9be22b639ea69e102d3847dca4c53ef025e9527b"]},"tags":{},"packages":[{"name":"tiff","source":"https://ubuntu.com/security/cve?package=tiff","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tiff","debian":"https://tracker.debian.org/pkg/tiff","statuses":[{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.5.0-6,4.5.1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"4.5.0-5ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4.3.0-6ubuntu0.10","component":null,"pocket":"security"}]}],"notices_ids":["USN-6290-1"],"notices":[{"id":"USN-6290-1","title":"LibTIFF vulnerabilities","summary":"Several security issues were fixed in LibTIFF.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-08-15T21:02:25.226937","description":"It was discovered that LibTIFF could be made to write out of bounds when\nprocessing certain malformed image files with the tiffcrop utility. If a\nuser were tricked into opening a specially crafted image file, an attacker\ncould possibly use this issue to cause tiffcrop to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-48281)\n\nIt was discovered that LibTIFF incorrectly handled certain image files. If\na user were tricked into opening a specially crafted image file, an\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 23.04. (CVE-2023-2731)\n\nIt was discovered that LibTIFF incorrectly handled certain image files\nwith the tiffcp utility. If a user were tricked into opening a specially\ncrafted image file, an attacker could possibly use this issue to cause\ntiffcp to crash, resulting in a denial of service. (CVE-2023-2908)\n\nIt was discovered that LibTIFF incorrectly handled certain file paths. If\na user were tricked into specifying certain output paths, an attacker\ncould possibly use this issue to cause a denial of service. This issue\nonly affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-3316)\n\nIt was discovered that LibTIFF could be made to write out of bounds when\nprocessing certain malformed image files. If a user were tricked into\nopening a specially crafted image file, an attacker could possibly use\nthis issue to cause a denial of service, or possibly execute arbitrary\ncode. (CVE-2023-3618)\n\nIt was discovered that LibTIFF could be made to write out of bounds when\nprocessing certain malformed image files. If a user were tricked into\nopening a specially crafted image file, an attacker could possibly use\nthis issue to cause a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and\nUbuntu 23.04. (CVE-2023-25433, CVE-2023-26966)\n\nIt was discovered that LibTIFF did not properly managed memory when\nprocessing certain malformed image files with the tiffcrop utility. If a\nuser were tricked into opening a specially crafted image file, an attacker\ncould possibly use this issue to cause tiffcrop to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04.\n(CVE-2023-26965)\n\nIt was discovered that LibTIFF contained an arithmetic overflow. If a user\nwere tricked into opening a specially crafted image file, an attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2023-38288, CVE-2023-38289)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"tiff","version":"4.0.9-5ubuntu0.10+esm2","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-dev","version":"4.0.9-5ubuntu0.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff-doc","version":"4.0.9-5ubuntu0.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff-opengl","version":"4.0.9-5ubuntu0.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff-tools","version":"4.0.9-5ubuntu0.10+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff5","version":"4.0.9-5ubuntu0.10+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff5-dev","version":"4.0.9-5ubuntu0.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiffxx5","version":"4.0.9-5ubuntu0.10+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"}],"focal":[{"name":"tiff","version":"4.1.0+git191117-2ubuntu0.20.04.9","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-dev","version":"4.1.0+git191117-2ubuntu0.20.04.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.9","pocket":"security"},{"name":"libtiff-doc","version":"4.1.0+git191117-2ubuntu0.20.04.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.9","pocket":"security"},{"name":"libtiff-opengl","version":"4.1.0+git191117-2ubuntu0.20.04.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.9","pocket":"security"},{"name":"libtiff-tools","version":"4.1.0+git191117-2ubuntu0.20.04.9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.9","pocket":"security"},{"name":"libtiff5","version":"4.1.0+git191117-2ubuntu0.20.04.9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.9","pocket":"security"},{"name":"libtiff5-dev","version":"4.1.0+git191117-2ubuntu0.20.04.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.9","pocket":"security"},{"name":"libtiffxx5","version":"4.1.0+git191117-2ubuntu0.20.04.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.9","pocket":"security"}],"jammy":[{"name":"tiff","version":"4.3.0-6ubuntu0.5","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-dev","version":"4.3.0-6ubuntu0.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.5","pocket":"security"},{"name":"libtiff-doc","version":"4.3.0-6ubuntu0.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.5","pocket":"security"},{"name":"libtiff-opengl","version":"4.3.0-6ubuntu0.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.5","pocket":"security"},{"name":"libtiff-tools","version":"4.3.0-6ubuntu0.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.5","pocket":"security"},{"name":"libtiff5","version":"4.3.0-6ubuntu0.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.5","pocket":"security"},{"name":"libtiff5-dev","version":"4.3.0-6ubuntu0.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.5","pocket":"security"},{"name":"libtiffxx5","version":"4.3.0-6ubuntu0.5","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.5","pocket":"security"}],"lunar":[{"name":"tiff","version":"4.5.0-5ubuntu1.1","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-dev","version":"4.5.0-5ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.5.0-5ubuntu1.1","pocket":"security"},{"name":"libtiff-doc","version":"4.5.0-5ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.5.0-5ubuntu1.1","pocket":"security"},{"name":"libtiff-opengl","version":"4.5.0-5ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.5.0-5ubuntu1.1","pocket":"security"},{"name":"libtiff-tools","version":"4.5.0-5ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.5.0-5ubuntu1.1","pocket":"security"},{"name":"libtiff5-dev","version":"4.5.0-5ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.5.0-5ubuntu1.1","pocket":"security"},{"name":"libtiff6","version":"4.5.0-5ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.5.0-5ubuntu1.1","pocket":"security"},{"name":"libtiffxx6","version":"4.5.0-5ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.5.0-5ubuntu1.1","pocket":"security"}],"trusty":[{"name":"tiff","version":"4.0.3-7ubuntu0.11+esm9","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-doc","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff-opengl","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff-tools","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff4-dev","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff5","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff5-alt-dev","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff5-dev","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiffxx5","version":"4.0.3-7ubuntu0.11+esm9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"tiff","version":"4.0.6-1ubuntu0.8+esm12","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-doc","version":"4.0.6-1ubuntu0.8+esm12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff-opengl","version":"4.0.6-1ubuntu0.8+esm12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff-tools","version":"4.0.6-1ubuntu0.8+esm12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff5","version":"4.0.6-1ubuntu0.8+esm12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiff5-dev","version":"4.0.6-1ubuntu0.8+esm12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"},{"name":"libtiffxx5","version":"4.0.6-1ubuntu0.8+esm12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2022-48281","CVE-2023-2908","CVE-2023-3316","CVE-2023-3618","CVE-2023-38288","CVE-2023-25433","CVE-2023-38289","CVE-2023-2731","CVE-2023-26966","CVE-2023-26965"]}]},{"id":"CVE-2023-24805","published":"2023-05-17T00:00:00","updated_at":"2025-08-26T00:09:30.607106+00:00","description":"\ncups-filters contains backends, filters, and other software required to get\nthe cups printing service working on operating systems other than macos. If\nyou use the Backend Error Handler (beh) to create an accessible network\nprinter, this security vulnerability can cause remote code execution.\n`beh.c` contains the line `retval = system(cmdline) >> 8;` which calls the\n`system` command with the operand `cmdline`. `cmdline` contains multiple\nuser controlled, unsanitized values. As a result an attacker with network\naccess to the hosted print server can exploit this vulnerability to inject\nsystem commands which are executed in the context of the running server.\nThis issue has been addressed in commit `8f2740357` and is expected to be\nbundled in the next release. Users are advised to upgrade when possible and\nto restrict access to network printers in the meantime.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-6083-1","https://ubuntu.com/security/notices/USN-6083-2","https://www.cve.org/CVERecord?id=CVE-2023-24805"],"bugs":["https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-gpxc-v2m8-fr3x"],"patches":{"cups-filters":["upstream: https://github.com/OpenPrinting/cups-filters/commit/8f274035756c04efeb77eb654e9d4c4447287d65"]},"tags":{},"packages":[{"name":"cups-filters","source":"https://ubuntu.com/security/cve?package=cups-filters","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=cups-filters","debian":"https://tracker.debian.org/pkg/cups-filters","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.8.3-2ubuntu3.5+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"bionic","status":"released","description":"1.20.2-0ubuntu3.3","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1.27.4-1ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.28.15-0ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"1.28.16-1ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"2.0~rc1-0ubuntu1.2","component":null,"pocket":"security"}]}],"notices_ids":["USN-6083-1","USN-6083-2"],"notices":[{"id":"USN-6083-1","title":"cups-filters vulnerability","summary":"cups-filters could be made to crash or run programs if it received\nspecially crafted network traffic.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-05-17T14:31:21.350172","description":"It was discovered that cups-filters incorrectly handled the beh CUPS\nbackend. A remote attacker could possibly use this issue to cause the\nbackend to stop responding or to execute arbitrary code.\n","is_hidden":false,"release_packages":{"kinetic":[{"name":"cups-filters","version":"1.28.16-1ubuntu0.2","description":"OpenPrinting CUPS Filters","is_source":true},{"name":"libfontembed-dev","version":"1.28.16-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.16-1ubuntu0.2","pocket":"security"},{"name":"libfontembed1","version":"1.28.16-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.16-1ubuntu0.2","pocket":"security"},{"name":"libcupsfilters-dev","version":"1.28.16-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.16-1ubuntu0.2","pocket":"security"},{"name":"cups-filters","version":"1.28.16-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.16-1ubuntu0.2","pocket":"security"},{"name":"cups-browsed","version":"1.28.16-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.16-1ubuntu0.2","pocket":"security"},{"name":"cups-filters-core-drivers","version":"1.28.16-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.16-1ubuntu0.2","pocket":"security"},{"name":"libcupsfilters1","version":"1.28.16-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.16-1ubuntu0.2","pocket":"security"}],"jammy":[{"name":"cups-filters","version":"1.28.15-0ubuntu1.2","description":"OpenPrinting CUPS Filters","is_source":true},{"name":"libfontembed-dev","version":"1.28.15-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.15-0ubuntu1.2","pocket":"security"},{"name":"libfontembed1","version":"1.28.15-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.15-0ubuntu1.2","pocket":"security"},{"name":"libcupsfilters-dev","version":"1.28.15-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.15-0ubuntu1.2","pocket":"security"},{"name":"cups-filters","version":"1.28.15-0ubuntu1.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.15-0ubuntu1.2","pocket":"security"},{"name":"cups-browsed","version":"1.28.15-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.15-0ubuntu1.2","pocket":"security"},{"name":"cups-filters-core-drivers","version":"1.28.15-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.15-0ubuntu1.2","pocket":"security"},{"name":"libcupsfilters1","version":"1.28.15-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.28.15-0ubuntu1.2","pocket":"security"}],"focal":[{"name":"cups-filters","version":"1.27.4-1ubuntu0.2","description":"OpenPrinting CUPS Filters","is_source":true},{"name":"libfontembed-dev","version":"1.27.4-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.27.4-1ubuntu0.2","pocket":"security"},{"name":"libfontembed1","version":"1.27.4-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.27.4-1ubuntu0.2","pocket":"security"},{"name":"libcupsfilters-dev","version":"1.27.4-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.27.4-1ubuntu0.2","pocket":"security"},{"name":"cups-filters","version":"1.27.4-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.27.4-1ubuntu0.2","pocket":"security"},{"name":"cups-browsed","version":"1.27.4-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.27.4-1ubuntu0.2","pocket":"security"},{"name":"cups-filters-core-drivers","version":"1.27.4-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.27.4-1ubuntu0.2","pocket":"security"},{"name":"libcupsfilters1","version":"1.27.4-1ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.27.4-1ubuntu0.2","pocket":"security"}],"bionic":[{"name":"cups-filters","version":"1.20.2-0ubuntu3.3","description":"OpenPrinting CUPS Filters","is_source":true},{"name":"libfontembed-dev","version":"1.20.2-0ubuntu3.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.20.2-0ubuntu3.3","pocket":"security"},{"name":"libfontembed1","version":"1.20.2-0ubuntu3.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.20.2-0ubuntu3.3","pocket":"security"},{"name":"libcupsfilters-dev","version":"1.20.2-0ubuntu3.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.20.2-0ubuntu3.3","pocket":"security"},{"name":"cups-filters","version":"1.20.2-0ubuntu3.3","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.20.2-0ubuntu3.3","pocket":"security"},{"name":"cups-browsed","version":"1.20.2-0ubuntu3.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.20.2-0ubuntu3.3","pocket":"security"},{"name":"cups-filters-core-drivers","version":"1.20.2-0ubuntu3.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.20.2-0ubuntu3.3","pocket":"security"},{"name":"libcupsfilters1","version":"1.20.2-0ubuntu3.3","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/1.20.2-0ubuntu3.3","pocket":"security"}],"lunar":[{"name":"cups-filters","version":"2.0~rc1-0ubuntu1.2","description":"OpenPrinting CUPS Filters","is_source":true},{"name":"cups-filters-core-drivers","version":"2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/2.0~rc1-0ubuntu1.2","pocket":"security"},{"name":"cups-filters","version":"2.0~rc1-0ubuntu1.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":"https://launchpad.net/ubuntu/+source/cups-filters/2.0~rc1-0ubuntu1.2","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2023-24805"]},{"id":"USN-6083-2","title":"cups-filters vulnerability","summary":"cups-filters could be made to crash or run programs if it received\nspecially crafted network traffic.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-06-19T13:33:27.784581","description":"USN-6083-1 fixed a vulnerability in cups-filters. This update provides\nthe corresponding update for Ubuntu 16.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that cups-filters incorrectly handled the beh CUPS\n backend. A remote attacker could possibly use this issue to cause the\n backend to stop responding or to execute arbitrary code.\n","is_hidden":false,"release_packages":{"xenial":[{"name":"cups-filters","version":"1.8.3-2ubuntu3.5+esm1","description":"OpenPrinting CUPS Filters","is_source":true},{"name":"libfontembed-dev","version":"1.8.3-2ubuntu3.5+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":null,"pocket":"esm-infra"},{"name":"libfontembed1","version":"1.8.3-2ubuntu3.5+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":null,"pocket":"esm-infra"},{"name":"libcupsfilters-dev","version":"1.8.3-2ubuntu3.5+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":null,"pocket":"esm-infra"},{"name":"cups-filters","version":"1.8.3-2ubuntu3.5+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":null,"pocket":"esm-infra"},{"name":"cups-browsed","version":"1.8.3-2ubuntu3.5+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":null,"pocket":"esm-infra"},{"name":"cups-filters-core-drivers","version":"1.8.3-2ubuntu3.5+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":null,"pocket":"esm-infra"},{"name":"libcupsfilters1","version":"1.8.3-2ubuntu3.5+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/cups-filters","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2023-24805"]}]},{"id":"CVE-2023-2295","published":"2023-05-17T00:00:00","updated_at":"2025-07-11T07:54:00.516169+00:00","description":"\nA vulnerability was found in the libreswan library. This security issue\noccurs when an IKEv1 Aggressive Mode packet is received with only\nunacceptable crypto algorithms, and the response packet is not sent with a\nzero responder SPI. When a subsequent packet is received where the sender\nreuses the libreswan responder SPI as its own initiator SPI, the pluto\ndaemon state machine crashes. No remote code execution is possible. This\nCVE exists because of a CVE-2023-30570 security regression for libreswan\npackage in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://rhn.redhat.com/errata/RHSA-2023-3107.html","https://www.cve.org/CVERecord?id=CVE-2023-2295"],"bugs":[""],"patches":{"libreswan":[]},"tags":{},"packages":[{"name":"libreswan","source":"https://ubuntu.com/security/cve?package=libreswan","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libreswan","debian":"https://tracker.debian.org/pkg/libreswan","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-27131","published":"2023-05-16T20:15:00","updated_at":"2025-08-04T19:35:28.917495+00:00","description":"\nMoodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS)\ndue to the improper input sanitization on the \"Additional HTML Section\" via\n\"Header and Footer\" parameter in /admin/settings.php. This vulnerability is\nleading an attacker to steal admin and all user account cookies by storing\nthe malicious XSS payload in Header and Footer. NOTE: this is disputed by\nthe vendor because the \"Additional HTML Section\" for \"Header and Footer\"\ncan only be supplied by an administrator, who is intentionally allowed to\nenter unsanitized input (e.g., site-specific JavaScript).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/p4nk4jv/CVEs-Assigned/blob/master/Moodle-3.10.1-CVE-2021-27131.md","https://github.com/moodle/moodle","https://www.cve.org/CVERecord?id=CVE-2021-27131"],"bugs":[""],"patches":{"moodle":[]},"tags":{},"packages":[{"name":"moodle","source":"https://ubuntu.com/security/cve?package=moodle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=moodle","debian":"https://tracker.debian.org/pkg/moodle","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"disputed","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"disputed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-2726","published":"2023-05-16T19:15:00","updated_at":"2025-08-26T00:10:20.629440+00:00","description":"\nInappropriate implementation in WebApp Installs in Google Chrome prior to\n113.0.5672.126 allowed an attacker who convinced a user to install a\nmalicious web app to bypass install dialog via a crafted HTML page.\n(Chromium security severity: Medium)","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser\nin Ubuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://crbug.com/1442018","https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html","https://www.cve.org/CVERecord?id=CVE-2023-2726"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"jammy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was needed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2023-2725","published":"2023-05-16T19:15:00","updated_at":"2025-08-26T00:10:20.629440+00:00","description":"\nUse after free in Guest View in Google Chrome prior to 113.0.5672.126\nallowed an attacker who convinced a user to install a malicious extension\nto potentially exploit heap corruption via a crafted HTML page. (Chromium\nsecurity severity: High)","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser\nin Ubuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html","https://crbug.com/1442516","https://www.cve.org/CVERecord?id=CVE-2023-2725"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"jammy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was needed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":34660,"limit":20,"total_results":79316}