{"cves":[{"id":"CVE-2020-13577","published":"2021-02-10T00:00:00","updated_at":"2025-08-26T12:19:15.310212+00:00","description":"\nA denial-of-service vulnerability exists in the WS-Security plugin\nfunctionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request\ncan lead to denial of service. An attacker can send an HTTP request to\ntrigger this vulnerability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://talosintelligence.com/vulnerability_reports/TALOS-2020-1188","https://www.cve.org/CVERecord?id=CVE-2020-13577"],"bugs":[""],"patches":{"gsoap":[]},"tags":{},"packages":[{"name":"gsoap","source":"https://ubuntu.com/security/cve?package=gsoap","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gsoap","debian":"https://tracker.debian.org/pkg/gsoap","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.104-3","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-13576","published":"2021-02-10T00:00:00","updated_at":"2025-08-26T12:19:15.310212+00:00","description":"\nA code execution vulnerability exists in the WS-Addressing plugin\nfunctionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request\ncan lead to remote code execution. An attacker can send an HTTP request to\ntrigger this vulnerability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://talosintelligence.com/vulnerability_reports/TALOS-2020-1187","https://www.cve.org/CVERecord?id=CVE-2020-13576"],"bugs":[""],"patches":{"gsoap":[]},"tags":{},"packages":[{"name":"gsoap","source":"https://ubuntu.com/security/cve?package=gsoap","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gsoap","debian":"https://tracker.debian.org/pkg/gsoap","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.104-3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"2.8.117-2build1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26958","published":"2021-02-09T23:15:00","updated_at":"2025-08-21T15:30:11.776119+00:00","description":"\nAn issue was discovered in the xcb crate through 2021-02-04 for Rust. It\nhas a soundness violation because transmutation to the wrong type can\nhappen after xcb::base::cast_event uses std::mem::transmute to return a\nreference to an arbitrary type.","ubuntu_description":"","notes":[{"author":"gianz","note":"the issue was addressed in version 1.0.0, which underwent a complete\nrefactoring and a change in the api. Addressing the issue on versions\n<1.0.0 is likely to require a version change."}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2021-0019.html","https://www.cve.org/CVERecord?id=CVE-2021-26958"],"bugs":[""],"patches":{"rust-xcb":[]},"tags":{},"packages":[{"name":"rust-xcb","source":"https://ubuntu.com/security/cve?package=rust-xcb","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-xcb","debian":"https://tracker.debian.org/pkg/rust-xcb","statuses":[{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"risk of regression","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2.2-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.4.0-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.0-beta.0","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26957","published":"2021-02-09T23:15:00","updated_at":"2025-08-21T15:30:11.776119+00:00","description":"\nAn issue was discovered in the xcb crate through 2021-02-04 for Rust. It\nhas a soundness violation because there is an out-of-bounds read in\nxcb::xproto::change_property(), as demonstrated by a format=32 T=u8\nsituation where out-of-bounds bytes are sent to an X server.","ubuntu_description":"","notes":[{"author":"gianz","note":"the issue was addressed in version 1.0.0, which underwent a complete\nrefactoring and a change in the api. Addressing the issue on versions\n<1.0.0 is likely to require a version change."}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2021-0019.html","https://www.cve.org/CVERecord?id=CVE-2021-26957"],"bugs":[""],"patches":{"rust-xcb":[]},"tags":{},"packages":[{"name":"rust-xcb","source":"https://ubuntu.com/security/cve?package=rust-xcb","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-xcb","debian":"https://tracker.debian.org/pkg/rust-xcb","statuses":[{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"risk of regression","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2.2-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.4.0-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.0-beta.0","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26956","published":"2021-02-09T23:15:00","updated_at":"2025-08-21T15:30:11.776119+00:00","description":"\nAn issue was discovered in the xcb crate through 2021-02-04 for Rust. It\nhas a soundness violation because bytes from an X server can be interpreted\nas any data type returned by xcb::xproto::GetPropertyReply::value.","ubuntu_description":"","notes":[{"author":"gianz","note":"the issue was addressed in version 1.0.0, which underwent a complete\nrefactoring and a change in the api. Addressing the issue on versions\n<1.0.0 is likely to require a version change."}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2021-0019.html","https://www.cve.org/CVERecord?id=CVE-2021-26956"],"bugs":[""],"patches":{"rust-xcb":[]},"tags":{},"packages":[{"name":"rust-xcb","source":"https://ubuntu.com/security/cve?package=rust-xcb","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-xcb","debian":"https://tracker.debian.org/pkg/rust-xcb","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"risk of regression","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2.2-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.4.0-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.0-beta.0","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26955","published":"2021-02-09T23:15:00","updated_at":"2025-08-21T15:30:11.776119+00:00","description":"\nAn issue was discovered in the xcb crate through 2021-02-04 for Rust. It\nhas a soundness violation because xcb::xproto::GetAtomNameReply::name()\ncalls std::str::from_utf8_unchecked() on unvalidated bytes from an X\nserver.","ubuntu_description":"","notes":[{"author":"gianz","note":"the issue was addressed in version 1.0.0, which underwent a complete\nrefactoring and a change in the api. Addressing the issue on versions\n<1.0.0 is likely to require a version change."}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2021-0019.html","https://www.cve.org/CVERecord?id=CVE-2021-26955"],"bugs":[""],"patches":{"rust-xcb":[]},"tags":{},"packages":[{"name":"rust-xcb","source":"https://ubuntu.com/security/cve?package=rust-xcb","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-xcb","debian":"https://tracker.debian.org/pkg/rust-xcb","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"ignored","description":"risk of regression","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.2.2-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.4.0-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.0-beta.0","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-14343","published":"2021-02-09T21:15:00","updated_at":"2025-08-25T23:20:29.958718+00:00","description":"\nA vulnerability was discovered in the PyYAML library in versions before\n5.4, where it is susceptible to arbitrary code execution when it processes\nuntrusted YAML files through the full_load method or with the FullLoader\nloader. Applications that use the library to process untrusted input may be\nvulnerable to this flaw. This flaw allows an attacker to execute arbitrary\ncode on the system by abusing the python/object/new constructor. This flaw\nis due to an incomplete fix for CVE-2020-1747.","ubuntu_description":"","notes":[{"author":"sbeattie","note":"incomplete fix of CVE-2020-1747"},{"author":"mdeslaur","note":"FullLoader was introduced in 5.1. FullLoader should not be used\non untrusted input."}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation","https://ubuntu.com/security/notices/USN-4940-1","https://www.cve.org/CVERecord?id=CVE-2020-14343"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966233","https://github.com/yaml/pyyaml/issues/420"],"patches":{"pyyaml":["upstream: https://github.com/yaml/pyyaml/commit/7adc0db3f613a82669f2b168edd98379b83adb3c"]},"tags":{},"packages":[{"name":"pyyaml","source":"https://ubuntu.com/security/cve?package=pyyaml","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=pyyaml","debian":"https://tracker.debian.org/pkg/pyyaml","statuses":[{"release_codename":"groovy","status":"released","description":"5.3.1-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"5.3.1-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"5.3.1-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"5.4.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-4940-1"],"notices":[{"id":"USN-4940-1","title":"PyYAML vulnerability","summary":"PyYAML could be made to run programs if it opened a specially crafted YAML\nfile.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-05-10T14:19:33.037369","description":"It was discovered that PyYAML incorrectly handled untrusted YAML files with\nthe FullLoader loader. A remote attacker could possibly use this issue to\nexecute arbitrary code.\n","is_hidden":false,"release_packages":{"focal":[{"name":"pyyaml","version":"5.3.1-1ubuntu0.1","description":"YAML parser and emitter for Python","is_source":true},{"name":"python-yaml","version":"5.3.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/pyyaml","version_link":"https://launchpad.net/ubuntu/+source/pyyaml/5.3.1-1ubuntu0.1","pocket":"security"},{"name":"python3-yaml","version":"5.3.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/pyyaml","version_link":"https://launchpad.net/ubuntu/+source/pyyaml/5.3.1-1ubuntu0.1","pocket":"security"}],"groovy":[{"name":"pyyaml","version":"5.3.1-2ubuntu0.1","description":"YAML parser and emitter for Python","is_source":true},{"name":"python3-yaml","version":"5.3.1-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/pyyaml","version_link":"https://launchpad.net/ubuntu/+source/pyyaml/5.3.1-2ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14343"]}]},{"id":"CVE-2020-28645","published":"2021-02-09T19:15:00","updated_at":"2025-08-25T23:25:44.018075+00:00","description":"\nDeleting users with certain names caused system files to be deleted. Risk\nis higher for systems which allow users to register themselves and have the\ndata directory in the web root. This affects ownCloud/core versions < 10.6.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://owncloud.com/security-advisories/missing-user-validation-leading-to-information-disclosure/","https://www.cve.org/CVERecord?id=CVE-2020-28645"],"bugs":[""],"patches":{"owncloud":[]},"tags":{},"packages":[{"name":"owncloud","source":"https://ubuntu.com/security/cve?package=owncloud","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=owncloud","debian":"https://tracker.debian.org/pkg/owncloud","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-28644","published":"2021-02-09T19:15:00","updated_at":"2025-08-25T23:25:44.018075+00:00","description":"\nThe CSRF (Cross Site Request Forgery) token check was improperly\nimplemented on cookie authenticated requests against some ocs API\nendpoints. This affects ownCloud/core version < 10.6.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":4.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://owncloud.com/security-advisories/cross-site-request-forgery-in-the-ocs-api/","https://www.cve.org/CVERecord?id=CVE-2020-28644"],"bugs":[""],"patches":{"owncloud":[]},"tags":{},"packages":[{"name":"owncloud","source":"https://ubuntu.com/security/cve?package=owncloud","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=owncloud","debian":"https://tracker.debian.org/pkg/owncloud","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2019-17582","published":"2021-02-09T19:15:00","updated_at":"2025-08-25T23:08:12.011823+00:00","description":"\nA use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip\n1.2.0 allows attackers to have an unspecified impact by attempting to unzip\na malformed ZIP archive. NOTE: the discoverer states \"This use-after-free\nis triggered prior to the double free reported in CVE-2017-12858.\"","ubuntu_description":"","notes":[{"author":"leosilva","note":"Introduced after: https://github.com/nih-at/libzip/commit/796c5968ad679220db3fb65ec6f48c66e554e5d5\n(rel-1-2-0)"},{"author":"ccdm94","note":"the fix for this CVE is the same as the one for CVE-2017-12858,\nhowever, the issues are different."}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796","https://github.com/nih-at/libzip/issues/5","https://libzip.org/libzip-discuss/","https://www.cve.org/CVERecord?id=CVE-2019-17582"],"bugs":[""],"patches":{"libzip":["upstream: https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796"]},"tags":{},"packages":[{"name":"libzip","source":"https://ubuntu.com/security/cve?package=libzip","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libzip","debian":"https://tracker.debian.org/pkg/libzip","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"1.5.1-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"1.7.3-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"1.7.3-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.3.0","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35572","published":"2021-02-09T18:15:00","updated_at":"2025-08-25T23:26:13.001785+00:00","description":"\nAdminer through 4.7.8 allows XSS via the history parameter to the default\nURI.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://sourceforge.net/p/adminer/bugs-and-features/775/","https://sourceforge.net/p/adminer/news/","https://ubuntu.com/security/notices/USN-5271-1","https://www.cve.org/CVERecord?id=CVE-2020-35572"],"bugs":[""],"patches":{"adminer":["upstream: https://github.com/vrana/adminer/commit/5c395afc098e501be3417017c6421968aac477bd"]},"tags":{},"packages":[{"name":"adminer","source":"https://ubuntu.com/security/cve?package=adminer","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adminer","debian":"https://tracker.debian.org/pkg/adminer","statuses":[{"release_codename":"impish","status":"not-affected","description":"4.7.9-2","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.7.9","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"4.7.6-1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"jammy","status":"not-affected","description":"4.8.1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4.8.1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4.8.1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4.8.1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4.8.1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4.8.1-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4.8.1-1","component":null,"pocket":"security"}]}],"notices_ids":["USN-5271-1"],"notices":[{"id":"USN-5271-1","title":"Adminer vulnerabilities","summary":"Several security issues were fixed in Adminer.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2022-06-03T13:18:00.182566","description":"It was discovered that Adminer did not escape data in the history parameter\nof the default URI. A remote attacker could possibly use this issue to perform\ncross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM.\n(CVE-2020-35572)\n\nAdam Crosser and Brian Sizemore discovered that Adminer incorrectly handled\nredirection requests to internal servers. An unauthenticated remote attacker\ncould possibly use this to perform a server-side request forgery attack and\nexpose sensitive information. (CVE-2021-21311)\n\nIt was discovered that Adminer was incorrectly escaping data in the doc_link\nfunction. A remote attacker could possibly use this issue to perform cross-site\nscripting (XSS) attacks. This issue only affected Ubuntu 18.04 ESM and\nUbuntu 20.04 ESM. (CVE-2021-29625)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"adminer","version":"4.6.2-1ubuntu0.1~esm1","description":"Web-based database administration tool","is_source":true},{"name":"adminer","version":"4.6.2-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adminer","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"adminer","version":"4.7.6-1ubuntu0.1~esm1","description":"Web-based database administration tool","is_source":true},{"name":"adminer","version":"4.7.6-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adminer","version_link":null,"pocket":"esm-apps"}],"xenial":[{"name":"adminer","version":"4.2.1-1ubuntu1+esm1","description":"Web-based database administration tool","is_source":true},{"name":"adminer","version":"4.2.1-1ubuntu1+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adminer","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2021-21311","CVE-2021-29625","CVE-2020-35572"]}]},{"id":"CVE-2020-16144","published":"2021-02-09T18:15:00","updated_at":"2025-08-25T23:22:23.855488+00:00","description":"\nWhen using an object storage like S3 as the file store, when a user creates\na public link to a folder where anonymous users can upload files, and\nanother user uploads a virus the files antivirus app would detect the virus\nbut fails to delete it due to permission issues. This affects the\nfiles_antivirus component versions before 0.15.2 for ownCloud.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://owncloud.com/security-advisories/files-antivirus-doesnt-delete-virus-if-uploaded-through-public-link/","https://www.cve.org/CVERecord?id=CVE-2020-16144"],"bugs":[""],"patches":{"owncloud":[]},"tags":{},"packages":[{"name":"owncloud","source":"https://ubuntu.com/security/cve?package=owncloud","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=owncloud","debian":"https://tracker.debian.org/pkg/owncloud","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-26676","published":"2021-02-09T16:15:00","updated_at":"2025-08-25T23:34:02.477591+00:00","description":"\ngdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to\nleak sensitive stack information, allowing further exploitation of bugs in\ngdhcp.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"ADJACENT","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=58d397ba74873384aee449690a9070bacd5676fa","https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=a74524b3e3fad81b0fd1084ffdf9f2ea469cd9b1","https://bugzilla.suse.com/show_bug.cgi?id=1181751","https://git.kernel.org/pub/scm/network/connman/connman.git/tree/ChangeLog","https://www.openwall.com/lists/oss-security/2021/02/08/2","https://ubuntu.com/security/notices/USN-6236-1","https://www.cve.org/CVERecord?id=CVE-2021-26676"],"bugs":[""],"patches":{"connman":[]},"tags":{},"packages":[{"name":"connman","source":"https://ubuntu.com/security/cve?package=connman","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=connman","debian":"https://tracker.debian.org/pkg/connman","statuses":[{"release_codename":"jammy","status":"not-affected","description":"1.36-2.3build1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.41-2","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.41-2","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.36-2.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.21-1.2+deb8u1ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"bionic","status":"released","description":"1.35-6ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"focal","status":"released","description":"1.36-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":["USN-6236-1"],"notices":[{"id":"USN-6236-1","title":"ConnMan vulnerabilities","summary":"Several security issues were fixed in ConnMan.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-07-19T08:45:49.026763","description":"It was discovered that ConnMan could be made to write out of bounds. A\nremote attacker could possibly use this issue to cause ConnMan to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2021-26675, CVE-2021-33833)\n\nIt was discovered that ConnMan could be made to leak sensitive information\nvia the gdhcp component. A remote attacker could possibly use this issue\nto obtain information for further exploitation. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-26676)\n\nIt was discovered that ConnMan could be made to read out of bounds. A\nremote attacker could possibly use this issue to case ConnMan to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-23096, CVE-2022-23097)\n\nIt was discovered that ConnMan could be made to run into an infinite loop.\nA remote attacker could possibly use this issue to cause ConnMan to\nconsume resources and to stop operating, resulting in a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, and Ubuntu 22.04 LTS. (CVE-2022-23098)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gweb component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32292)\n\nIt was discovered that ConnMan did not properly manage memory under\ncertain circumstances. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32293)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gdhcp component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2023-28488)\n","is_hidden":false,"release_packages":{"xenial":[{"name":"connman","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-doc","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-vpn","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-dev","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"}],"jammy":[{"name":"connman","version":"1.36-2.3ubuntu0.1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"},{"name":"connman-doc","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"},{"name":"connman-vpn","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"},{"name":"connman-dev","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"}],"focal":[{"name":"connman","version":"1.36-2ubuntu0.1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"},{"name":"connman-doc","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"},{"name":"connman-vpn","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"},{"name":"connman-dev","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"}],"bionic":[{"name":"connman","version":"1.35-6ubuntu0.1~esm1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-doc","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-vpn","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-dev","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"}],"lunar":[{"name":"connman","version":"1.41-2ubuntu0.23.04.1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"},{"name":"connman-doc","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"},{"name":"connman-vpn","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"},{"name":"connman-dev","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2021-26676","CVE-2022-32293","CVE-2023-28488","CVE-2022-23098","CVE-2021-26675","CVE-2021-33833","CVE-2022-23097","CVE-2022-23096","CVE-2022-32292"]}]},{"id":"CVE-2021-26675","published":"2021-02-09T16:15:00","updated_at":"2025-08-25T23:34:02.477591+00:00","description":"\nA stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be\nused by network adjacent attackers to execute code.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"ADJACENT","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=e4079a20f617a4b076af503f6e4e8b0304c9f2cb","https://bugzilla.suse.com/show_bug.cgi?id=1181751","https://git.kernel.org/pub/scm/network/connman/connman.git/tree/ChangeLog","https://www.openwall.com/lists/oss-security/2021/02/08/2","https://ubuntu.com/security/notices/USN-6236-1","https://www.cve.org/CVERecord?id=CVE-2021-26675"],"bugs":[""],"patches":{"connman":[]},"tags":{},"packages":[{"name":"connman","source":"https://ubuntu.com/security/cve?package=connman","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=connman","debian":"https://tracker.debian.org/pkg/connman","statuses":[{"release_codename":"jammy","status":"not-affected","description":"1.36-2.3build1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.41-2","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.41-2","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.36-2.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.35-6ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"focal","status":"released","description":"1.36-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":["USN-6236-1"],"notices":[{"id":"USN-6236-1","title":"ConnMan vulnerabilities","summary":"Several security issues were fixed in ConnMan.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-07-19T08:45:49.026763","description":"It was discovered that ConnMan could be made to write out of bounds. A\nremote attacker could possibly use this issue to cause ConnMan to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2021-26675, CVE-2021-33833)\n\nIt was discovered that ConnMan could be made to leak sensitive information\nvia the gdhcp component. A remote attacker could possibly use this issue\nto obtain information for further exploitation. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-26676)\n\nIt was discovered that ConnMan could be made to read out of bounds. A\nremote attacker could possibly use this issue to case ConnMan to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-23096, CVE-2022-23097)\n\nIt was discovered that ConnMan could be made to run into an infinite loop.\nA remote attacker could possibly use this issue to cause ConnMan to\nconsume resources and to stop operating, resulting in a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, and Ubuntu 22.04 LTS. (CVE-2022-23098)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gweb component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32292)\n\nIt was discovered that ConnMan did not properly manage memory under\ncertain circumstances. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32293)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gdhcp component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2023-28488)\n","is_hidden":false,"release_packages":{"xenial":[{"name":"connman","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-doc","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-vpn","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-dev","version":"1.21-1.2+deb8u1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"}],"jammy":[{"name":"connman","version":"1.36-2.3ubuntu0.1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"},{"name":"connman-doc","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"},{"name":"connman-vpn","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"},{"name":"connman-dev","version":"1.36-2.3ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2.3ubuntu0.1","pocket":"security"}],"focal":[{"name":"connman","version":"1.36-2ubuntu0.1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"},{"name":"connman-doc","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"},{"name":"connman-vpn","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"},{"name":"connman-dev","version":"1.36-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.36-2ubuntu0.1","pocket":"security"}],"bionic":[{"name":"connman","version":"1.35-6ubuntu0.1~esm1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-doc","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-vpn","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"},{"name":"connman-dev","version":"1.35-6ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":null,"pocket":"esm-apps"}],"lunar":[{"name":"connman","version":"1.41-2ubuntu0.23.04.1","description":"Intel Connection Manager daemon","is_source":true},{"name":"connman","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"},{"name":"connman-doc","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"},{"name":"connman-vpn","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"},{"name":"connman-dev","version":"1.41-2ubuntu0.23.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/connman","version_link":"https://launchpad.net/ubuntu/+source/connman/1.41-2ubuntu0.23.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2021-26676","CVE-2022-32293","CVE-2023-28488","CVE-2022-23098","CVE-2021-26675","CVE-2021-33833","CVE-2022-23097","CVE-2022-23096","CVE-2022-32292"]}]},{"id":"CVE-2021-21148","published":"2021-02-09T16:15:00","updated_at":"2025-08-25T23:31:17.627106+00:00","description":"\nHeap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed\na remote attacker to potentially exploit heap corruption via a crafted HTML\npage.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html","https://crbug.com/1170176","https://www.cve.org/CVERecord?id=CVE-2021-21148","https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21147","published":"2021-02-09T15:15:00","updated_at":"2025-08-25T23:31:17.627106+00:00","description":"\nInappropriate implementation in Skia in Google Chrome prior to\n88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox\n(URL bar) via a crafted HTML page.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":4.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html","https://crbug.com/1162942","https://www.cve.org/CVERecord?id=CVE-2021-21147"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21146","published":"2021-02-09T15:15:00","updated_at":"2025-08-25T23:31:13.147989+00:00","description":"\nUse after free in Navigation in Google Chrome prior to 88.0.4324.146\nallowed a remote attacker who had compromised the renderer process to\npotentially perform a sandbox escape via a crafted HTML page.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":9.6,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html","https://crbug.com/1161705","https://www.cve.org/CVERecord?id=CVE-2021-21146"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21145","published":"2021-02-09T15:15:00","updated_at":"2025-08-25T23:31:13.147989+00:00","description":"\nUse after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a\nremote attacker to potentially exploit heap corruption via a crafted HTML\npage.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html","https://crbug.com/1154965","https://www.cve.org/CVERecord?id=CVE-2021-21145"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21144","published":"2021-02-09T15:15:00","updated_at":"2025-08-25T23:31:13.147989+00:00","description":"\nHeap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146\nallowed an attacker who convinced a user to install a malicious extension\nto potentially exploit heap corruption via a crafted Chrome Extension.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"negligible","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html","https://crbug.com/1163845","https://www.cve.org/CVERecord?id=CVE-2021-21144"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-21143","published":"2021-02-09T15:15:00","updated_at":"2025-08-25T23:31:13.147989+00:00","description":"\nHeap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146\nallowed an attacker who convinced a user to install a malicious extension\nto potentially exploit heap corruption via a crafted Chrome Extension.","ubuntu_description":"","notes":[{"author":"alexmurray","note":"The Debian chromium source package is called chromium-browser in\nUbuntu"},{"author":"mdeslaur","note":"starting with Ubuntu 19.10, the chromium-browser package is just\na script that installs the Chromium snap"}],"codename":null,"priority":"negligible","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html","https://crbug.com/1163504","https://www.cve.org/CVERecord?id=CVE-2021-21143"],"bugs":[""],"patches":{"chromium-browser":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"bionic","status":"released","description":"89.0.4389.82-0ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"89.0.4389.82-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"focal was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":43400,"limit":20,"total_results":79316}