{"cves":[{"id":"CVE-2020-35921","published":"2020-12-31T09:15:00","updated_at":"2025-08-26T12:24:57.391697+00:00","description":"\nAn issue was discovered in the miow crate before 0.3.6 for Rust. It has\nfalse expectations about the std::net::SocketAddr memory representation.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0080.html","https://github.com/yoshuawuyts/miow/issues/38","https://www.cve.org/CVERecord?id=CVE-2020-35921"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976871"],"patches":{"rust-miow":[]},"tags":{},"packages":[{"name":"rust-miow","source":"https://ubuntu.com/security/cve?package=rust-miow","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-miow","debian":"https://tracker.debian.org/pkg/rust-miow","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.3.7-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.3.6-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.3.7-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.3.7-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.3.7-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.3.7-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.3.7-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35920","published":"2020-12-31T09:15:00","updated_at":"2025-08-26T12:24:57.391697+00:00","description":"\nAn issue was discovered in the socket2 crate before 0.3.16 for Rust. It has\nfalse expectations about the std::net::SocketAddr memory representation.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0079.html","https://github.com/rust-lang/socket2-rs/issues/119","https://www.cve.org/CVERecord?id=CVE-2020-35920"],"bugs":[""],"patches":{"rust-socket2":[]},"tags":{},"packages":[{"name":"rust-socket2","source":"https://ubuntu.com/security/cve?package=rust-socket2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-socket2","debian":"https://tracker.debian.org/pkg/rust-socket2","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.3.19-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35919","published":"2020-12-31T09:15:00","updated_at":"2025-08-26T12:24:57.391697+00:00","description":"\nAn issue was discovered in the net2 crate before 0.2.36 for Rust. It has\nfalse expectations about the std::net::SocketAddr memory representation.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0078.html","https://github.com/deprecrated/net2-rs/issues/105","https://www.cve.org/CVERecord?id=CVE-2020-35919"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976870"],"patches":{"rust-net2":[]},"tags":{},"packages":[{"name":"rust-net2","source":"https://ubuntu.com/security/cve?package=rust-net2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-net2","debian":"https://tracker.debian.org/pkg/rust-net2","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.2.37-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.2.37-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.2.37-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.2.37-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.2.37-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.2.37-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.2.37-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.2.37-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35914","published":"2020-12-31T09:15:00","updated_at":"2025-07-11T07:45:27.556493+00:00","description":"\nAn issue was discovered in the lock_api crate before 0.4.2 for Rust. A data\nrace can occur because of RwLockWriteGuard unsoundness.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":4.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0070.html","https://github.com/Amanieu/parking_lot/pull/262","https://www.cve.org/CVERecord?id=CVE-2020-35914"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975319"],"patches":{"rust-lock-api":[]},"tags":{},"packages":[{"name":"rust-lock-api","source":"https://ubuntu.com/security/cve?package=rust-lock-api","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-lock-api","debian":"https://tracker.debian.org/pkg/rust-lock-api","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35913","published":"2020-12-31T09:15:00","updated_at":"2025-07-11T07:45:25.317198+00:00","description":"\nAn issue was discovered in the lock_api crate before 0.4.2 for Rust. A data\nrace can occur because of RwLockReadGuard unsoundness.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":4.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0070.html","https://github.com/Amanieu/parking_lot/pull/262","https://www.cve.org/CVERecord?id=CVE-2020-35913"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975319"],"patches":{"rust-lock-api":[]},"tags":{},"packages":[{"name":"rust-lock-api","source":"https://ubuntu.com/security/cve?package=rust-lock-api","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-lock-api","debian":"https://tracker.debian.org/pkg/rust-lock-api","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35912","published":"2020-12-31T09:15:00","updated_at":"2025-07-11T07:45:25.317198+00:00","description":"\nAn issue was discovered in the lock_api crate before 0.4.2 for Rust. A data\nrace can occur because of MappedRwLockWriteGuard unsoundness.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":4.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0070.html","https://github.com/Amanieu/parking_lot/pull/262","https://www.cve.org/CVERecord?id=CVE-2020-35912"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975319"],"patches":{"rust-lock-api":[]},"tags":{},"packages":[{"name":"rust-lock-api","source":"https://ubuntu.com/security/cve?package=rust-lock-api","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-lock-api","debian":"https://tracker.debian.org/pkg/rust-lock-api","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35911","published":"2020-12-31T09:15:00","updated_at":"2025-07-11T07:45:25.317198+00:00","description":"\nAn issue was discovered in the lock_api crate before 0.4.2 for Rust. A data\nrace can occur because of MappedRwLockReadGuard unsoundness.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":4.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0070.html","https://github.com/Amanieu/parking_lot/pull/262","https://www.cve.org/CVERecord?id=CVE-2020-35911"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975319"],"patches":{"rust-lock-api":[]},"tags":{},"packages":[{"name":"rust-lock-api","source":"https://ubuntu.com/security/cve?package=rust-lock-api","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-lock-api","debian":"https://tracker.debian.org/pkg/rust-lock-api","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35910","published":"2020-12-31T09:15:00","updated_at":"2025-07-11T07:45:25.317198+00:00","description":"\nAn issue was discovered in the lock_api crate before 0.4.2 for Rust. A data\nrace can occur because of MappedMutexGuard unsoundness.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0070.html","https://github.com/Amanieu/parking_lot/pull/262","https://www.cve.org/CVERecord?id=CVE-2020-35910"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975319"],"patches":{"rust-lock-api":[]},"tags":{},"packages":[{"name":"rust-lock-api","source":"https://ubuntu.com/security/cve?package=rust-lock-api","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-lock-api","debian":"https://tracker.debian.org/pkg/rust-lock-api","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35907","published":"2020-12-31T09:15:00","updated_at":"2025-07-11T07:45:25.317198+00:00","description":"\nAn issue was discovered in the futures-task crate before 0.3.5 for Rust.\nfutures_task::noop_waker_ref allows a NULL pointer dereference.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/rust-lang/futures-rs/issues/2091","https://rustsec.org/advisories/RUSTSEC-2020-0061.html","https://www.cve.org/CVERecord?id=CVE-2020-35907"],"bugs":[""],"patches":{"rust-futures-task":[]},"tags":{},"packages":[{"name":"rust-futures-task","source":"https://ubuntu.com/security/cve?package=rust-futures-task","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-futures-task","debian":"https://tracker.debian.org/pkg/rust-futures-task","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"debian: Fixed before the initial upload to Debian","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35906","published":"2020-12-31T09:15:00","updated_at":"2025-07-11T07:45:25.317198+00:00","description":"\nAn issue was discovered in the futures-task crate before 0.3.6 for Rust.\nfutures_task::waker may cause a use-after-free in a non-static type\nsituation.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/rust-lang/futures-rs/pull/2206","https://rustsec.org/advisories/RUSTSEC-2020-0060.html","https://www.cve.org/CVERecord?id=CVE-2020-35906"],"bugs":[""],"patches":{"rust-futures-task":[]},"tags":{},"packages":[{"name":"rust-futures-task","source":"https://ubuntu.com/security/cve?package=rust-futures-task","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-futures-task","debian":"https://tracker.debian.org/pkg/rust-futures-task","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"debian: Fixed before the initial upload to Debian","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-35904","published":"2020-12-31T09:15:00","updated_at":"2025-08-26T12:24:57.391697+00:00","description":"\nAn issue was discovered in the crossbeam-channel crate before 0.4.4 for\nRust. It has incorrect expectations about the relationship between the\nmemory allocation and how many iterator elements there are.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0052.html","https://github.com/crossbeam-rs/crossbeam/pull/533","https://www.cve.org/CVERecord?id=CVE-2020-35904"],"bugs":[""],"patches":{"rust-crossbeam-channel":[]},"tags":{},"packages":[{"name":"rust-crossbeam-channel","source":"https://ubuntu.com/security/cve?package=rust-crossbeam-channel","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-crossbeam-channel","debian":"https://tracker.debian.org/pkg/rust-crossbeam-channel","statuses":[{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.4.4-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-12658","published":"2020-12-31T01:15:00","updated_at":"2025-08-04T19:35:00.633512+00:00","description":"\ngssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before\npthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment\nstates \"We are already on a shutdown path when running the code in\nquestion, so a DoS there doesn't make any sense, and there has been no\nadditional information provided us (as upstream) to indicate why this would\nbe a problem.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/gssapi/gssproxy/commit/cb761412e299ef907f22cd7c4146d50c8a792003 (v0.8.3)","https://github.com/gssapi/gssproxy/commit/cb761412e299ef907f22cd7c4146d50c8a792003","https://github.com/gssapi/gssproxy/compare/v0.8.2...v0.8.3","https://pagure.io/gssproxy/c/cb761412e299ef907f22cd7c4146d50c8a792003?branch=master","https://www.cve.org/CVERecord?id=CVE-2020-12658"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978931"],"patches":{"gssproxy":[]},"tags":{},"packages":[{"name":"gssproxy","source":"https://ubuntu.com/security/cve?package=gssproxy","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gssproxy","debian":"https://tracker.debian.org/pkg/gssproxy","statuses":[{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"disputed","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"disputed","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"disputed","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"disputed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-11947","published":"2020-12-31T01:15:00","updated_at":"2026-06-09T18:41:05.491727+00:00","description":"\niscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer\nover-read that may disclose unrelated information from process memory to an\nattacker.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4725-1","https://www.cve.org/CVERecord?id=CVE-2020-11947","https://ubuntu.com/security/notices/USN-8412-1"],"bugs":[""],"patches":{"qemu-kvm":[],"qemu":["upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=ff0507c239a246fd7215b31c5658fc6a3ee1e4c5"]},"tags":{},"packages":[{"name":"qemu","source":"https://ubuntu.com/security/cve?package=qemu","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu","debian":"https://tracker.debian.org/pkg/qemu","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1:2.11+dfsg-1ubuntu7.35","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1:4.2-3ubuntu6.12","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1:2.5+dfsg-5ubuntu10.49","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"1:5.0-5ubuntu9.2","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1:5.2+dfsg-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.0.0+dfsg-2ubuntu1.47+esm6","component":null,"pocket":"esm-infra-legacy"}]},{"name":"qemu-kvm","source":"https://ubuntu.com/security/cve?package=qemu-kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu-kvm","debian":"https://tracker.debian.org/pkg/qemu-kvm","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4725-1","USN-8412-1"],"notices":[{"id":"USN-4725-1","title":"QEMU vulnerabilities","summary":"Several security issues were fixed in QEMU.\n","instructions":"After a standard system update you need to restart all QEMU virtual\nmachines to make all the necessary changes.\n","references":[],"published":"2021-02-08T13:12:32.676592","description":"It was discovered that QEMU incorrectly handled memory in iSCSI emulation.\nAn attacker inside the guest could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-11947)\n\nAlexander Bulekov discovered that QEMU incorrectly handled Intel e1000e\nemulation. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2020-15859)\n\nAlexander Bulekov discovered that QEMU incorrectly handled memory region\ncache. An attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n20.04 LTS, and Ubuntu 20.10. (CVE-2020-27821)\n\nCheol-woo Myung discovered that QEMU incorrectly handled Intel e1000e\nemulation. An attacker inside the guest could use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, and Ubuntu 20.10. (CVE-2020-28916)\n\nWenxiang Qian discovered that QEMU incorrectly handled ATAPI emulation. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2020-29443)\n\nIt was discovered that QEMU incorrectly handled VirtFS directory sharing.\nAn attacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2021-20181)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"qemu","version":"1:2.11+dfsg-1ubuntu7.35","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-block-extra","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-guest-agent","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-kvm","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-arm","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-common","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-mips","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-misc","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-ppc","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-s390x","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-sparc","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-system-x86","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-user","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-user-binfmt","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-user-static","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"},{"name":"qemu-utils","version":"1:2.11+dfsg-1ubuntu7.35","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.35","pocket":"security"}],"focal":[{"name":"qemu","version":"1:4.2-3ubuntu6.12","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-block-extra","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-guest-agent","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-kvm","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-arm","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-common","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-data","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-gui","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-mips","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-misc","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-ppc","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-s390x","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-sparc","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-x86","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-x86-microvm","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-system-x86-xen","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-user","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-user-binfmt","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-user-static","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"},{"name":"qemu-utils","version":"1:4.2-3ubuntu6.12","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.12","pocket":"security"}],"groovy":[{"name":"qemu","version":"1:5.0-5ubuntu9.4","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-block-extra","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-guest-agent","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-kvm","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-arm","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-common","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-data","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-gui","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-mips","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-misc","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-ppc","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-s390x","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-sparc","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-x86","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-x86-microvm","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-system-x86-xen","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-user","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-user-binfmt","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-user-static","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"},{"name":"qemu-utils","version":"1:5.0-5ubuntu9.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.4","pocket":"security"}],"xenial":[{"name":"qemu","version":"1:2.5+dfsg-5ubuntu10.49","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-block-extra","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-guest-agent","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-kvm","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-aarch64","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-arm","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-common","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-mips","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-misc","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-ppc","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-s390x","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-sparc","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-system-x86","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-user","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-user-binfmt","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-user-static","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"},{"name":"qemu-utils","version":"1:2.5+dfsg-5ubuntu10.49","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.49","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-15859","CVE-2020-27821","CVE-2020-28916","CVE-2020-29443","CVE-2020-11947","CVE-2021-20181"]},{"id":"USN-8412-1","title":"QEMU vulnerabilities","summary":"Several security issues were fixed in QEMU.","instructions":"After a standard system update you need to restart all QEMU virtual\nmachines to make all the necessary changes.","references":[],"published":"2026-06-09T16:22:49.156514","description":"Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the\niSCSI block driver in QEMU incorrectly handled certain responses from an\niSCSI server. A remote attacker could possibly use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)\n\nIt was discovered that the iSCSI block driver in QEMU incorrectly handled\ncertain memory operations, leading to a heap-based buffer over-read. An\nattacker could possibly use this issue to expose sensitive information from\nthe host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)\n\nZiming Zhang discovered that the SM501 display driver in QEMU contained an\ninteger overflow. A local attacker could possibly use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS. (CVE-2020-12829)\n\nGaoning Pan and Xingwei Li discovered that the USB xHCI controller\nimplementation in QEMU contained an infinite loop. An attacker inside the\nguest could possibly use this issue to cause QEMU to hang, resulting in a\ndenial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04\nLTS, and Ubuntu 18.04 LTS. (CVE-2020-14394)\n\nLei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps\nobjects, leading to a NULL pointer dereference. An attacker inside the\nguest could possibly use this issue to cause QEMU to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2020-15469)\n\nAlexander Bulekov discovered that the e1000e network device implementation\nin QEMU contained a use-after-free. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)\n\nZiming Zhang discovered that the XGMAC Ethernet controller in QEMU\ncontained a buffer overflow. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2020-15863)\n\nAlexander Bulekov discovered that the SDHCI device emulation in QEMU\ncontained a heap-based buffer overflow. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS. (CVE-2020-17380)\n\nSergej Schumilo, Cornelius Aschermann, and Simon Wörner discovered that the\nUSB xHCI controller implementation in QEMU did not check a return value,\nleading to a use-after-free. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2020-25084)\n\nGaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI\ncontroller implementation in QEMU contained a stack-based buffer over-read.\nAn attacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS. (CVE-2020-25624)\n\nIt was discovered that the USB OHCI controller implementation in QEMU\ncontained an infinite loop. An attacker inside the guest could possibly use\nthis issue to cause QEMU to consume resources, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)\n\nCheolwoo Myung discovered that the USB EHCI emulation in QEMU did not\nhandle DMA memory map failures, leading to a reachable assertion. An\nattacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS. (CVE-2020-25723)\n\nGaoning Pan discovered that the network device emulation in QEMU could be\nmade to trigger an assertion failure when processing packets that lacked a\nvalid layer 3 protocol. An attacker inside the guest could possibly use\nthis issue to cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2020-27617)\n\nWenxiang Qian discovered that the ATAPI emulation in QEMU did not properly\nvalidate a buffer index, leading to an out-of-bounds read. An attacker\ninside the guest could possibly use this issue to expose sensitive\ninformation or cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2020-29443)\n\nCheolwoo Myung discovered that the ESP SCSI emulation in QEMU contained a\nNULL pointer dereference. An attacker inside the guest could possibly use\nthis issue to cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35504)\n\nCheolwoo Myung discovered that the am53c974 SCSI host bus adapter emulation\nin QEMU contained a NULL pointer dereference. An attacker inside the guest\ncould possibly use this issue to cause QEMU to crash, resulting in a denial\nof service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2020-35505)\n\nIt was discovered that the SDHCI controller emulation in QEMU contained\nout-of-bounds read and write issues. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3409)\n\nIt was discovered that several network device emulations in QEMU contained\nan infinite loop when operating in loopback mode. An attacker inside the\nguest could possibly use this issue to cause QEMU to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2021-3416)\n\nAlexander Bulekov discovered that the floppy disk emulation in QEMU\ncontained a heap-based buffer overflow. An attacker inside the guest could\npossibly use this issue to expose sensitive information or cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3507)\n\nRemy Noel discovered that the USB redirector device emulation in QEMU\nperformed an unbounded stack allocation when combining USB packets. An\nattacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3527)\n\nIt was discovered that the QXL display device emulation in QEMU contained\nan integer overflow, leading to a heap-based buffer overflow. An attacker\ninside the guest could possibly use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4206)\n\nIt was discovered that the QXL display device emulation in QEMU performed a\ndouble fetch of guest-controlled values, leading to a heap-based buffer\noverflow. An attacker inside the guest could possibly use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04\nLTS. (CVE-2021-4207)\n\nIt was discovered that the 9pfs server implementation in QEMU contained a\nrace condition, leading to a use-after-free. A malicious 9p client could\npossibly use this issue to escalate privileges. This issue only affected\nUbuntu 14.04 LTS. (CVE-2021-20181)\n\nGaoning Pan discovered that the floppy disk emulation in QEMU contained a\nNULL pointer dereference. An attacker inside the guest could possibly use\nthis issue to cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20196)\n\nGaoning Pan discovered that the vmxnet3 network device emulation in QEMU\ncontained an integer overflow. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2021-20203)\n\nIt was discovered that the ARM Generic Interrupt Controller emulation in\nQEMU contained an out-of-bounds heap access. An attacker inside the guest\ncould possibly use this issue to cause QEMU to crash, resulting in a denial\nof service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2021-20221)\n\nAlexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann,\nand Simon Wörner discovered that the e1000 network device emulation in QEMU\ncontained an infinite loop. An attacker inside the guest could possibly use\nthis issue to cause QEMU to consume resources, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2021-20257)\n\nIt was discovered that the 9p passthrough file system implementation in\nQEMU did not prevent opening special files on the host. A malicious guest\ncould possibly use this issue to escape the exported 9p tree. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.\n(CVE-2023-2861)\n\nIt was discovered that the virtio crypto device emulation in QEMU did not\nproperly validate certain buffer lengths, leading to a heap buffer\noverflow. An attacker inside the guest could possibly use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-3180)\n\nIt was discovered that the built-in VNC server in QEMU contained a NULL\npointer dereference when cleaning up a connection that failed during the\nhandshake. A remote attacker could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n18.04 LTS. (CVE-2023-3354)\n\nIt was discovered that QEMU could incorrectly direct a guest I/O operation\nto disk offset 0 instead of the intended offset. An attacker inside the\nguest could possibly use this issue to read or overwrite sensitive data,\npotentially gaining control of the host. This issue only affected Ubuntu\n14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-5088)\n\nIt was discovered that several virtio device emulations in QEMU did not\nproperly guard against DMA reentrancy, leading to a double free. An\nattacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2024-3446)\n\nIt was discovered that the SDHCI device emulation in QEMU contained a heap-\nbased buffer overflow. An attacker inside the guest could possibly use this\nissue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2024-3447)\n\nIt was discovered that the QEMU disk image utility (qemu-img) did not\nproperly handle certain crafted image files. An attacker could possibly use\nthis issue to cause qemu-img to consume excessive resources or access an\nunintended external file, resulting in a denial of service. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2024-4467)\n\nCyrille Chatras discovered that the LSI53C895A SCSI Host Bus Adapter\nemulation in QEMU contained a use-after-free. An attacker inside the guest\ncould possibly use this issue to cause QEMU to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2024-6519)\n\nIt was discovered that the NBD server in QEMU contained an improper\nsynchronization issue during socket closure. A remote attacker could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice. (CVE-2024-7409)\n\nIt was discovered that the USB emulation in QEMU contained a reachable\nassertion. An attacker inside the guest could possibly use this issue to\ncause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)\n\nIt was discovered that QEMU incorrectly handled resources during the VNC\nWebSocket handshake, leading to a use-after-free. A remote attacker could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2025-11234)\n\nIt was discovered that QEMU could be made to read out of bounds when\nreading VMDK images. An attacker could possibly use this issue to expose\nsensitive information or cause QEMU to crash, resulting in a denial of\nservice. (CVE-2026-2243)","is_hidden":false,"release_packages":{"bionic":[{"name":"qemu","version":"1:2.11+dfsg-1ubuntu7.42+esm5","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-block-extra","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-guest-agent","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-kvm","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-arm","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-common","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-mips","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-misc","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-ppc","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-s390x","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-sparc","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-x86","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-user","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-user-binfmt","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-user-static","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-utils","version":"1:2.11+dfsg-1ubuntu7.42+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"}],"focal":[{"name":"qemu","version":"1:4.2-3ubuntu6.30+esm1","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-block-extra","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-guest-agent","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-kvm","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-arm","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-common","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-data","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-gui","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-mips","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-misc","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-ppc","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-s390x","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-sparc","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-x86","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-x86-microvm","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-system-x86-xen","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-user","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-user-binfmt","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-user-static","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"},{"name":"qemu-utils","version":"1:4.2-3ubuntu6.30+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra"}],"trusty":[{"name":"qemu","version":"2.0.0+dfsg-2ubuntu1.47+esm6","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-common","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-guest-agent","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-keymaps","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-kvm","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-aarch64","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-arm","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-common","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-mips","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-misc","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-ppc","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-sparc","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-x86","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-user","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-user-static","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-utils","version":"2.0.0+dfsg-2ubuntu1.47+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"}],"xenial":[{"name":"qemu","version":"1:2.5+dfsg-5ubuntu10.51+esm4","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-block-extra","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-guest-agent","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-kvm","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-aarch64","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-arm","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-common","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-mips","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-misc","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-ppc","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-s390x","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-sparc","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-system-x86","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-user","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-user-binfmt","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-user-static","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"},{"name":"qemu-utils","version":"1:2.5+dfsg-5ubuntu10.51+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":null,"pocket":"esm-infra-legacy"}]},"type":"USN","cves_ids":["CVE-2021-3416","CVE-2020-15469","CVE-2020-1711","CVE-2021-3409","CVE-2024-3447","CVE-2023-5088","CVE-2020-29443","CVE-2020-35504","CVE-2020-35505","CVE-2020-25723","CVE-2021-4206","CVE-2024-3446","CVE-2024-7409","CVE-2024-8354","CVE-2020-11947","CVE-2026-2243","CVE-2023-3180","CVE-2021-4207","CVE-2021-20221","CVE-2020-27617","CVE-2023-3354","CVE-2020-14394","CVE-2020-15863","CVE-2020-25084","CVE-2024-6519","CVE-2024-4467","CVE-2021-3527","CVE-2020-25625","CVE-2021-20257","CVE-2020-25624","CVE-2021-3507","CVE-2025-11234","CVE-2021-20203","CVE-2020-17380","CVE-2023-2861","CVE-2021-20196","CVE-2021-20181","CVE-2020-12829","CVE-2020-15859"]}]},{"id":"CVE-2019-20808","published":"2020-12-31T01:15:00","updated_at":"2025-08-25T23:10:08.053880+00:00","description":"\nIn QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA\nimplementation. It occurs in the ati_cursor_define() routine while handling\nMMIO write operations through the ati_mm_write() callback. A malicious\nguest could abuse this flaw to crash the QEMU process, resulting in a\ndenial of service.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2019-20808"],"bugs":[""],"patches":{"qemu-kvm":[],"qemu":["upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=aab0e2a661b2b6bf7915c0aefe807fb60d6d9d13"]},"tags":{},"packages":[{"name":"qemu","source":"https://ubuntu.com/security/cve?package=qemu","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu","debian":"https://tracker.debian.org/pkg/qemu","statuses":[{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"1:4.2-3ubuntu6.3","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"qemu-kvm","source":"https://ubuntu.com/security/cve?package=qemu-kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu-kvm","debian":"https://tracker.debian.org/pkg/qemu-kvm","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-36332","published":"2020-12-31T00:00:00","updated_at":"2025-08-18T17:13:51.457020+00:00","description":"\nA flaw was found in libwebp in versions before 1.0.1. When reading a file\nlibwebp allocates an excessive amount of memory. The highest threat from\nthis vulnerability is to the service availability.","ubuntu_description":"","notes":[{"author":"leosilva","note":"backporting this to xenial is too intrusive, hence we will not be fixing\nthis in xenial/esm neither in trusty/esm."}],"codename":null,"priority":"low","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4971-1","https://www.cve.org/CVERecord?id=CVE-2020-36332"],"bugs":["https://bugs.chromium.org/p/webp/issues/detail?id=391"],"patches":{"libwebp":["upstream: https://chromium.googlesource.com/webm/libwebp/+/dce5d7643177633ebe3513af492ea8c08c299cf3","upstream: https://chromium.googlesource.com/webm/libwebp/+/39cb9aad85ca7bb1d193013460db1f8cc6bff109"]},"tags":{},"packages":[{"name":"libwebp","source":"https://ubuntu.com/security/cve?package=libwebp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libwebp","debian":"https://tracker.debian.org/pkg/libwebp","statuses":[{"release_codename":"impish","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"0.6.1-2ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"0.6.1-2ubuntu0.20.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"0.6.1-2ubuntu0.20.10.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"0.6.1-2ubuntu0.21.04.1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-4971-1"],"notices":[{"id":"USN-4971-1","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-01T11:29:35.860242","description":"It was discovered that libwebp incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image file, a remote attacker could use this issue to cause libwebp\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","is_hidden":false,"release_packages":{"groovy":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.10.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"}],"hirsute":[{"name":"libwebp","version":"0.6.1-2ubuntu0.21.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"}],"focal":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"}],"bionic":[{"name":"libwebp","version":"0.6.1-2ubuntu0.18.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25010","CVE-2018-25011","CVE-2020-36330","CVE-2020-36329","CVE-2018-25013","CVE-2018-25009","CVE-2020-36332","CVE-2020-36328","CVE-2018-25014","CVE-2018-25012"]}]},{"id":"CVE-2020-36331","published":"2020-12-31T00:00:00","updated_at":"2025-08-25T23:26:31.652653+00:00","description":"\nA flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read\nwas found in function ChunkAssignData. The highest threat from this\nvulnerability is to data confidentiality and to the service availability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4971-1","https://ubuntu.com/security/notices/USN-4971-2","https://www.cve.org/CVERecord?id=CVE-2020-36331"],"bugs":["https://bugs.chromium.org/p/webp/issues/detail?id=388"],"patches":{"libwebp":["upstream: https://chromium.googlesource.com/webm/libwebp/+/be738c6d396fa5a272c1b209be4379a7532debfe"]},"tags":{},"packages":[{"name":"libwebp","source":"https://ubuntu.com/security/cve?package=libwebp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libwebp","debian":"https://tracker.debian.org/pkg/libwebp","statuses":[{"release_codename":"impish","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4.0-4ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.4.4-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"bionic","status":"released","description":"0.6.1-2ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"0.6.1-2ubuntu0.20.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"0.6.1-2ubuntu0.20.10.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"0.6.1-2ubuntu0.21.04.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-4971-1","USN-4971-2"],"notices":[{"id":"USN-4971-1","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-01T11:29:35.860242","description":"It was discovered that libwebp incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image file, a remote attacker could use this issue to cause libwebp\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","is_hidden":false,"release_packages":{"groovy":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.10.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"}],"hirsute":[{"name":"libwebp","version":"0.6.1-2ubuntu0.21.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"}],"focal":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"}],"bionic":[{"name":"libwebp","version":"0.6.1-2ubuntu0.18.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25010","CVE-2018-25011","CVE-2020-36330","CVE-2020-36329","CVE-2018-25013","CVE-2018-25009","CVE-2020-36332","CVE-2020-36328","CVE-2018-25014","CVE-2018-25012"]},{"id":"USN-4971-2","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-10T13:12:37.514917","description":"USN-4971-1 fixed several vulnerabilities in libwebp. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libwebp incorrectly handled certain malformed\n images. If a user or automated system were tricked into opening a specially\n crafted image file, a remote attacker could use this issue to cause libwebp\n to crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"libwebp","version":"0.4.0-4ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"libwebp","version":"0.4.4-1ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25014","CVE-2020-36328","CVE-2018-25012","CVE-2018-25009","CVE-2018-25013","CVE-2018-25011","CVE-2018-25010","CVE-2020-36330","CVE-2020-36329"]}]},{"id":"CVE-2020-36330","published":"2020-12-31T00:00:00","updated_at":"2025-08-25T23:26:31.652653+00:00","description":"\nA flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read\nwas found in function ChunkVerifyAndAssign. The highest threat from this\nvulnerability is to data confidentiality and to the service availability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4971-1","https://ubuntu.com/security/notices/USN-4971-2","https://www.cve.org/CVERecord?id=CVE-2020-36330"],"bugs":["https://bugs.chromium.org/p/webp/issues/detail?id=386"],"patches":{"libwebp":["upstream: https://chromium.googlesource.com/webm/libwebp/+/2c70ad76c94db5427d37ab4b85dc89b94dd75e01"]},"tags":{},"packages":[{"name":"libwebp","source":"https://ubuntu.com/security/cve?package=libwebp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libwebp","debian":"https://tracker.debian.org/pkg/libwebp","statuses":[{"release_codename":"impish","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4.0-4ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.4.4-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"bionic","status":"released","description":"0.6.1-2ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"0.6.1-2ubuntu0.20.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"0.6.1-2ubuntu0.20.10.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"0.6.1-2ubuntu0.21.04.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-4971-1","USN-4971-2"],"notices":[{"id":"USN-4971-1","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-01T11:29:35.860242","description":"It was discovered that libwebp incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image file, a remote attacker could use this issue to cause libwebp\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","is_hidden":false,"release_packages":{"groovy":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.10.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"}],"hirsute":[{"name":"libwebp","version":"0.6.1-2ubuntu0.21.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"}],"focal":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"}],"bionic":[{"name":"libwebp","version":"0.6.1-2ubuntu0.18.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25010","CVE-2018-25011","CVE-2020-36330","CVE-2020-36329","CVE-2018-25013","CVE-2018-25009","CVE-2020-36332","CVE-2020-36328","CVE-2018-25014","CVE-2018-25012"]},{"id":"USN-4971-2","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-10T13:12:37.514917","description":"USN-4971-1 fixed several vulnerabilities in libwebp. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libwebp incorrectly handled certain malformed\n images. If a user or automated system were tricked into opening a specially\n crafted image file, a remote attacker could use this issue to cause libwebp\n to crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"libwebp","version":"0.4.0-4ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"libwebp","version":"0.4.4-1ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25014","CVE-2020-36328","CVE-2018-25012","CVE-2018-25009","CVE-2018-25013","CVE-2018-25011","CVE-2018-25010","CVE-2020-36330","CVE-2020-36329"]}]},{"id":"CVE-2020-36329","published":"2020-12-31T00:00:00","updated_at":"2025-08-25T23:26:31.652653+00:00","description":"\nA flaw was found in libwebp in versions before 1.0.1. A use-after-free was\nfound due to a thread being killed too early. The highest threat from this\nvulnerability is to data confidentiality and integrity as well as system\navailability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4971-1","https://ubuntu.com/security/notices/USN-4971-2","https://www.cve.org/CVERecord?id=CVE-2020-36329"],"bugs":["https://bugs.chromium.org/p/webp/issues/detail?id=385"],"patches":{"libwebp":["upstream: https://chromium.googlesource.com/webm/libwebp/+/569001f19fc81fcb5ab358f587a54c62e7c4665c"]},"tags":{},"packages":[{"name":"libwebp","source":"https://ubuntu.com/security/cve?package=libwebp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libwebp","debian":"https://tracker.debian.org/pkg/libwebp","statuses":[{"release_codename":"jammy","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4.0-4ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.4.4-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"bionic","status":"released","description":"0.6.1-2ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"0.6.1-2ubuntu0.20.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"0.6.1-2ubuntu0.20.10.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"0.6.1-2ubuntu0.21.04.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-4971-1","USN-4971-2"],"notices":[{"id":"USN-4971-1","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-01T11:29:35.860242","description":"It was discovered that libwebp incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image file, a remote attacker could use this issue to cause libwebp\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","is_hidden":false,"release_packages":{"groovy":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.10.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"}],"hirsute":[{"name":"libwebp","version":"0.6.1-2ubuntu0.21.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"}],"focal":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"}],"bionic":[{"name":"libwebp","version":"0.6.1-2ubuntu0.18.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25010","CVE-2018-25011","CVE-2020-36330","CVE-2020-36329","CVE-2018-25013","CVE-2018-25009","CVE-2020-36332","CVE-2020-36328","CVE-2018-25014","CVE-2018-25012"]},{"id":"USN-4971-2","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-10T13:12:37.514917","description":"USN-4971-1 fixed several vulnerabilities in libwebp. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libwebp incorrectly handled certain malformed\n images. If a user or automated system were tricked into opening a specially\n crafted image file, a remote attacker could use this issue to cause libwebp\n to crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"libwebp","version":"0.4.0-4ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"libwebp","version":"0.4.4-1ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25014","CVE-2020-36328","CVE-2018-25012","CVE-2018-25009","CVE-2018-25013","CVE-2018-25011","CVE-2018-25010","CVE-2020-36330","CVE-2020-36329"]}]},{"id":"CVE-2020-36328","published":"2020-12-31T00:00:00","updated_at":"2025-08-25T23:26:31.652653+00:00","description":"\nA flaw was found in libwebp in versions before 1.0.1. A heap-based buffer\noverflow in function WebPDecodeRGBInto is possible due to an invalid check\nfor buffer size. The highest threat from this vulnerability is to data\nconfidentiality and integrity as well as system availability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4971-1","https://ubuntu.com/security/notices/USN-4971-2","https://www.cve.org/CVERecord?id=CVE-2020-36328"],"bugs":["https://bugs.chromium.org/p/webp/issues/detail?id=383"],"patches":{"libwebp":["upstream: https://chromium.googlesource.com/webm/libwebp/+/dad31750e374eff8e02fb467eb562d4bf236ed6e"]},"tags":{},"packages":[{"name":"libwebp","source":"https://ubuntu.com/security/cve?package=libwebp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libwebp","debian":"https://tracker.debian.org/pkg/libwebp","statuses":[{"release_codename":"jammy","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"0.6.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4.0-4ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.4.4-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"bionic","status":"released","description":"0.6.1-2ubuntu0.18.04.1","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"0.6.1-2ubuntu0.20.04.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"0.6.1-2ubuntu0.20.10.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"0.6.1-2ubuntu0.21.04.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-4971-1","USN-4971-2"],"notices":[{"id":"USN-4971-1","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-01T11:29:35.860242","description":"It was discovered that libwebp incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image file, a remote attacker could use this issue to cause libwebp\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","is_hidden":false,"release_packages":{"groovy":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.10.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.10.1","pocket":"security"}],"hirsute":[{"name":"libwebp","version":"0.6.1-2ubuntu0.21.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.21.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.21.04.1","pocket":"security"}],"focal":[{"name":"libwebp","version":"0.6.1-2ubuntu0.20.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.20.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.20.04.1","pocket":"security"}],"bionic":[{"name":"libwebp","version":"0.6.1-2ubuntu0.18.04.1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"webp","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp6","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpmux3","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebp-dev","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"},{"name":"libwebpdemux2","version":"0.6.1-2ubuntu0.18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":"https://launchpad.net/ubuntu/+source/libwebp/0.6.1-2ubuntu0.18.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25010","CVE-2018-25011","CVE-2020-36330","CVE-2020-36329","CVE-2018-25013","CVE-2018-25009","CVE-2020-36332","CVE-2020-36328","CVE-2018-25014","CVE-2018-25012"]},{"id":"USN-4971-2","title":"libwebp vulnerabilities","summary":"libwebp could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-06-10T13:12:37.514917","description":"USN-4971-1 fixed several vulnerabilities in libwebp. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libwebp incorrectly handled certain malformed\n images. If a user or automated system were tricked into opening a specially\n crafted image file, a remote attacker could use this issue to cause libwebp\n to crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"libwebp","version":"0.4.0-4ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.0-4ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"libwebp","version":"0.4.4-1ubuntu0.1~esm1","description":"Lossy compression of digital photographic images.","is_source":true},{"name":"libwebp-dev","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebp5","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpdemux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"libwebpmux1","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"},{"name":"webp","version":"0.4.4-1ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libwebp","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2020-36331","CVE-2018-25014","CVE-2020-36328","CVE-2018-25012","CVE-2018-25009","CVE-2018-25013","CVE-2018-25011","CVE-2018-25010","CVE-2020-36330","CVE-2020-36329"]}]},{"id":"CVE-2020-35916","published":"2020-12-31T00:00:00","updated_at":"2025-07-11T07:45:27.556493+00:00","description":"\nAn issue was discovered in the image crate before 0.23.12 for Rust. A\nMutable reference has immutable provenance. (In the case of LLVM, the IR\nmay be always correct.)","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://rustsec.org/advisories/RUSTSEC-2020-0073.html","https://github.com/image-rs/image/issues/1357","https://www.cve.org/CVERecord?id=CVE-2020-35916"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976869"],"patches":{"rust-image":[]},"tags":{},"packages":[{"name":"rust-image","source":"https://ubuntu.com/security/cve?package=rust-image","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rust-image","debian":"https://tracker.debian.org/pkg/rust-image","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":43780,"limit":20,"total_results":79316}