{"cves":[{"id":"CVE-2016-1925","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:55:45.113090+00:00","description":"\nInteger underflow in header.c in lha allows remote attackers to have\nunspecified impact via a large header size value for the (1) level0 or (2)\nlevel1 header in a lha archive, which triggers a buffer overflow.","ubuntu_description":"","notes":[{"author":"tyhicks","note":"The Precise lha code is quite a bit different but it looks like it is\nprobably affected"}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2016/01/18/3","https://www.cve.org/CVERecord?id=CVE-2016-1925"],"bugs":[""],"patches":{"lha":["upstream: https://osdn.jp/projects/lha/scm/git/lha/commits/bf2471f59ecc1aa45645d967bc9fa0efa3de3556"]},"tags":{},"packages":[{"name":"lha","source":"https://ubuntu.com/security/cve?package=lha","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=lha","debian":"https://tracker.debian.org/pkg/lha","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1417","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:54:07.499987+00:00","description":"\nUntrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote\nattackers to execute arbitrary code and conduct DLL hijacking attacks via a\nTrojan horse tcapi.dll that is located in the same folder on a remote file\nshare as a pcap file that is being processed.","ubuntu_description":"","notes":[{"author":"tyhicks","note":"Windows only"}],"codename":null,"priority":"high","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://hyp3rlinx.altervista.org/advisories/SNORT-DLL-HIJACK.txt","http://packetstormsecurity.com/files/138915/Snort-2.9.7.0-WIN32-DLL-Hijacking.html","http://www.securitytracker.com/id/1036936","https://www.cve.org/CVERecord?id=CVE-2016-1417"],"bugs":[""],"patches":{"snort":[]},"tags":{},"packages":[{"name":"snort","source":"https://ubuntu.com/security/cve?package=snort","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=snort","debian":"https://tracker.debian.org/pkg/snort","statuses":[{"release_codename":"precise","status":"not-affected","description":"Windows only","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"Windows only","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"Windows only","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"Windows only","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"Windows only","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8972","published":"2017-01-23T21:59:00","updated_at":"2025-08-26T11:53:19.413394+00:00","description":"\nStack-based buffer overflow in the ValidateMove function in\nfrontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow\ncontext-dependent attackers to execute arbitrary code via a large input, as\ndemonstrated when in UCI mode.","ubuntu_description":"","notes":[],"codename":null,"priority":"negligible","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["http://lists.gnu.org/archive/html/bug-gnu-chess/2015-10/msg00002.html","http://svn.savannah.gnu.org/viewvc?view=rev&root=chess&revision=134","https://www.cve.org/CVERecord?id=CVE-2015-8972"],"bugs":[""],"patches":{"gnuchess":[]},"tags":{},"packages":[{"name":"gnuchess","source":"https://ubuntu.com/security/cve?package=gnuchess","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gnuchess","debian":"https://tracker.debian.org/pkg/gnuchess","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"6.2.4-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"6.2.5-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8971","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:50:16.148927+00:00","description":"\nTerminology 0.7.0 allows remote attackers to execute arbitrary commands via\nescape sequences that modify the window title and then are written to the\nterminal, a similar issue to CVE-2003-0063.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2016/11/04/12","https://www.cve.org/CVERecord?id=CVE-2015-8971"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=843434"],"patches":{"terminology":["upstream: https://git.enlightenment.org/apps/terminology.git/commit/?id=b80bedc7c21ecffe99d8d142930db696eebdd6a5"]},"tags":{},"packages":[{"name":"terminology","source":"https://ubuntu.com/security/cve?package=terminology","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=terminology","debian":"https://tracker.debian.org/pkg/terminology","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.7.0-2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.7.0-1+deb8u1build0.16.04.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"released","description":"0.7.0-1+deb8u1build0.16.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8862","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:49:35.739869+00:00","description":"\nmustache package before 2.2.1 for Node.js allows remote attackers to\nconduct cross-site scripting (XSS) attacks by leveraging a template with an\nattribute that is not quoted.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2015-8862"],"bugs":[""],"patches":{"mustache.js":[]},"tags":{},"packages":[{"name":"mustache.js","source":"https://ubuntu.com/security/cve?package=mustache.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mustache.js","debian":"https://tracker.debian.org/pkg/mustache.js","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.3.0-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.3.0-2","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"2.3.0-2","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.3.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2.3.0-2","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8861","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:49:31.387438+00:00","description":"\nThe handlebars package before 4.0.0 for Node.js allows remote attackers to\nconduct cross-site scripting (XSS) attacks by leveraging a template with an\nattribute that is not quoted.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2015-8861"],"bugs":[""],"patches":{"node-handlebars":[]},"tags":{},"packages":[{"name":"node-handlebars","source":"https://ubuntu.com/security/cve?package=node-handlebars","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-handlebars","debian":"https://tracker.debian.org/pkg/node-handlebars","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"3:4.0.10-5","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"3:4.0.10-5","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.0.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8860","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:49:31.387438+00:00","description":"\nThe tar package before 2.0.0 for Node.js allows remote attackers to write\nto arbitrary files via a symlink attack in an archive.","ubuntu_description":"\nIt was discovered that node-tar mishandled certain tar archives. An attacker\ncould use this vulnerability to write arbitrary files to the filesystem.","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2015-8860","https://ubuntu.com/security/notices/USN-4777-1"],"bugs":[""],"patches":{"node-tar":["upstream: https://github.com/npm/node-tar/commit/a5337a6cd58a2d800fc03b3781a25751cf459f28","upstream: https://github.com/npm/node-tar/issues/54","upstream: https://github.com/npm/node-tar/pull/56","upstream: https://github.com/npm/node-tar/pull/56/commits/5e6356e0ca256cba659ff24d0befbfe753a04cb6","upstream: https://github.com/npm/node-tar/pull/56/commits/96355141e005fa192b4fd4c3134ec3bb824dfca8"]},"tags":{},"packages":[{"name":"node-tar","source":"https://ubuntu.com/security/cve?package=node-tar","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-tar","debian":"https://tracker.debian.org/pkg/node-tar","statuses":[{"release_codename":"impish","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.1.18-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"2.0.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"2.2.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.0.3-2ubuntu0.1~esm1","component":null,"pocket":"esm-apps"}]}],"notices_ids":["USN-4777-1"],"notices":[{"id":"USN-4777-1","title":"node-tar vulnerability","summary":"node-tar could be made to write arbitrary files to the filesystem if it\nopened a specially crafted tar archive.","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-03-15T20:52:28.648919","description":"It was discovered that node-tar mishandled certain tar archives. An\nattacker could use this vulnerability to write arbitrary files to the\nfilesystem.","is_hidden":false,"release_packages":{"trusty":[{"name":"node-tar","version":"0.1.18-1ubuntu0.1~esm1","description":"read and write portable tar archives module for Node.js","is_source":true},{"name":"node-tar","version":"0.1.18-1ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/node-tar","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"node-tar","version":"1.0.3-2ubuntu0.1~esm1","description":"read and write portable tar archives module for Node.js","is_source":true},{"name":"node-tar","version":"1.0.3-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/node-tar","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2015-8860"]}]},{"id":"CVE-2015-8859","published":"2017-01-23T21:59:00","updated_at":"2025-08-26T11:53:19.413394+00:00","description":"\nThe send package before 0.11.1 for Node.js allows attackers to obtain the\nroot path via unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2016/04/20/11","https://nodesecurity.io/advisories/56","https://www.cve.org/CVERecord?id=CVE-2015-8859"],"bugs":[""],"patches":{"node-send":["upstream: https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed"]},"tags":{},"packages":[{"name":"node-send","source":"https://ubuntu.com/security/cve?package=node-send","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-send","debian":"https://tracker.debian.org/pkg/node-send","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.11.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.16.2-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8858","published":"2017-01-23T21:59:00","updated_at":"2025-08-26T11:53:19.413394+00:00","description":"\nThe uglify-js package before 2.6.0 for Node.js allows attackers to cause a\ndenial of service (CPU consumption) via crafted input in a parse call, aka\na \"regular expression denial of service (ReDoS).\"","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2015-8858"],"bugs":[""],"patches":{"uglifyjs":[]},"tags":{},"packages":[{"name":"uglifyjs","source":"https://ubuntu.com/security/cve?package=uglifyjs","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=uglifyjs","debian":"https://tracker.debian.org/pkg/uglifyjs","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8857","published":"2017-01-23T21:59:00","updated_at":"2025-08-26T11:53:19.413394+00:00","description":"\nThe uglify-js package before 2.4.24 for Node.js does not properly account\nfor non-boolean values when rewriting boolean expressions, which might\nallow attackers to bypass security mechanisms or possibly have unspecified\nother impact by leveraging improperly rewritten Javascript.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/39","http://www.openwall.com/lists/oss-security/2016/04/20/11","https://www.cve.org/CVERecord?id=CVE-2015-8857"],"bugs":[""],"patches":{"uglifyjs":["upstream: https://github.com/mishoo/UglifyJS2/commit/905b6011784ca60d41919ac1a499962b7c1d4b02"]},"tags":{},"packages":[{"name":"uglifyjs","source":"https://ubuntu.com/security/cve?package=uglifyjs","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=uglifyjs","debian":"https://tracker.debian.org/pkg/uglifyjs","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.4.24","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"2.8.29-3","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8856","published":"2017-01-23T21:59:00","updated_at":"2025-08-26T11:53:19.413394+00:00","description":"\nCross-site scripting (XSS) vulnerability in the serve-index package before\n1.6.3 for Node.js allows remote attackers to inject arbitrary web script or\nHTML via a crafted file or directory name.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/serve-static-xss","https://github.com/expressjs/serve-index/issues/28","https://www.cve.org/CVERecord?id=CVE-2015-8856"],"bugs":[""],"patches":{"node-serve-index":[]},"tags":{},"packages":[{"name":"node-serve-index","source":"https://ubuntu.com/security/cve?package=node-serve-index","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-serve-index","debian":"https://tracker.debian.org/pkg/node-serve-index","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.9.1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8855","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:49:31.387438+00:00","description":"\nThe semver package before 4.3.2 for Node.js allows attackers to cause a\ndenial of service (CPU consumption) via a long version string, aka a\n\"regular expression denial of service (ReDoS).\"","ubuntu_description":"\nIt was discovered that semver incorrectly handled certain inputs. A remote\nattacker could possibly use this issue to cause a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/semver_redos","https://github.com/npm/npm/releases/tag/v2.7.5","https://www.cve.org/CVERecord?id=CVE-2015-8855","https://ubuntu.com/security/notices/USN-4776-1"],"bugs":[""],"patches":{"node-semver":[]},"tags":{},"packages":[{"name":"node-semver","source":"https://ubuntu.com/security/cve?package=node-semver","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-semver","debian":"https://tracker.debian.org/pkg/node-semver","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.3.0-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.1.0-2ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"5.4.1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.1.0-2ubuntu0.0.1~esm1","component":null,"pocket":"esm-infra"}]}],"notices_ids":["USN-4776-1"],"notices":[{"id":"USN-4776-1","title":"semver vulnerability","summary":"semver could be made to crash if it received specially crafted\ninput.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2021-03-15T20:51:27.487511","description":"It was discovered that semver incorrectly handled certain inputs. A remote\nattacker could possibly use this issue to cause a denial of service.","is_hidden":false,"release_packages":{"trusty":[{"name":"node-semver","version":"2.1.0-2ubuntu0.0.1~esm1","description":"Semantic Versioning for Node.js","is_source":true},{"name":"libjs-semver","version":"2.1.0-2ubuntu0.0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/node-semver","version_link":null,"pocket":"esm-infra"},{"name":"node-semver","version":"2.1.0-2ubuntu0.0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/node-semver","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"node-semver","version":"2.1.0-2ubuntu0.1~esm1","description":"Semantic Versioning for Node.js","is_source":true},{"name":"libjs-semver","version":"2.1.0-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/node-semver","version_link":null,"pocket":"esm-apps"},{"name":"node-semver","version":"2.1.0-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/node-semver","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2015-8855"]}]},{"id":"CVE-2015-8854","published":"2017-01-23T21:59:00","updated_at":"2025-08-26T11:53:19.413394+00:00","description":"\nThe marked package before 0.3.4 for Node.js allows attackers to cause a\ndenial of service (CPU consumption) via unspecified vectors that trigger a\n\"catastrophic backtracking issue for the em inline rule,\" aka a \"regular\nexpression denial of service (ReDoS).\"","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/marked_redos","https://github.com/chjj/marked/issues/497","https://www.cve.org/CVERecord?id=CVE-2015-8854"],"bugs":[""],"patches":{"node-marked":[]},"tags":{},"packages":[{"name":"node-marked","source":"https://ubuntu.com/security/cve?package=node-marked","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-marked","debian":"https://tracker.debian.org/pkg/node-marked","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.3.4","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.3.9+dfsg-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2014-9772","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:29:55.577889+00:00","description":"\nThe validator package before 2.0.0 for Node.js allows remote attackers to\nbypass the cross-site scripting (XSS) filter via hex-encoded characters.","ubuntu_description":"","notes":[{"author":"sbeattie","note":"upstream removed XSS filter entirely"}],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/chriso/validator.js/commit/2d5d6999541add350fb396ef02dc42ca3215049e","http://www.openwall.com/lists/oss-security/2016/04/20/11","https://nodesecurity.io/advisories/43","https://www.cve.org/CVERecord?id=CVE-2014-9772"],"bugs":[""],"patches":{"validator.js":[]},"tags":{},"packages":[{"name":"validator.js","source":"https://ubuntu.com/security/cve?package=validator.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=validator.js","debian":"https://tracker.debian.org/pkg/validator.js","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-7454","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:08:27.832508+00:00","description":"\nThe validator module before 1.1.0 for Node.js allows remote attackers to\nbypass the cross-site scripting (XSS) filter via nested forbidden strings.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/41","http://www.openwall.com/lists/oss-security/2016/04/20/11","https://www.cve.org/CVERecord?id=CVE-2013-7454"],"bugs":[""],"patches":{"validator.js":[]},"tags":{},"packages":[{"name":"validator.js","source":"https://ubuntu.com/security/cve?package=validator.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=validator.js","debian":"https://tracker.debian.org/pkg/validator.js","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.1.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-7453","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:08:27.832508+00:00","description":"\nThe validator module before 1.1.0 for Node.js allows remote attackers to\nbypass the cross-site scripting (XSS) filter via vectors related to UI\nredressing.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/41","http://www.openwall.com/lists/oss-security/2016/04/20/11","https://www.cve.org/CVERecord?id=CVE-2013-7453"],"bugs":[""],"patches":{"validator.js":[]},"tags":{},"packages":[{"name":"validator.js","source":"https://ubuntu.com/security/cve?package=validator.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=validator.js","debian":"https://tracker.debian.org/pkg/validator.js","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.1.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-7452","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:08:27.832508+00:00","description":"\nThe validator module before 1.1.0 for Node.js allows remote attackers to\nbypass the cross-site scripting (XSS) filter via a crafted javascript URI.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/41","http://www.openwall.com/lists/oss-security/2016/04/20/11","https://www.cve.org/CVERecord?id=CVE-2013-7452"],"bugs":[""],"patches":{"validator.js":[]},"tags":{},"packages":[{"name":"validator.js","source":"https://ubuntu.com/security/cve?package=validator.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=validator.js","debian":"https://tracker.debian.org/pkg/validator.js","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.1.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2013-7451","published":"2017-01-23T21:59:00","updated_at":"2025-08-25T21:08:27.832508+00:00","description":"\nThe validator module before 1.1.0 for Node.js allows remote attackers to\nbypass the XSS filter via a nested tag.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://nodesecurity.io/advisories/41","http://www.openwall.com/lists/oss-security/2016/04/20/11","https://www.cve.org/CVERecord?id=CVE-2013-7451"],"bugs":[""],"patches":{"validator.js":[]},"tags":{},"packages":[{"name":"validator.js","source":"https://ubuntu.com/security/cve?package=validator.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=validator.js","debian":"https://tracker.debian.org/pkg/validator.js","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.1.0","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.17.0+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-10156","published":"2017-01-23T07:59:00","updated_at":"2025-08-25T21:52:41.710493+00:00","description":"\nA flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid\nfiles to be created when using the systemd timers features, allowing local\nattackers to escalate their privileges to root. This is fixed in v229.","ubuntu_description":"","notes":[{"author":"tyhicks","note":"It looks to me like systemd from the stable phone overlay has the\nvulnerable code in src/shared/util.c. However, systemd is not used for pid 1\non the phone so marking that specific release as low."}],"codename":null,"priority":"high","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2016-10156"],"bugs":["https://bugzilla.suse.com/show_bug.cgi?id=1020601"],"patches":{"systemd":["upstream: https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e","upstream: https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f"]},"tags":{},"packages":[{"name":"systemd","source":"https://ubuntu.com/security/cve?package=systemd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=systemd","debian":"https://tracker.debian.org/pkg/systemd","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"229-4ubuntu16","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-5563","published":"2017-01-23T00:00:00","updated_at":"2025-08-25T22:34:48.626806+00:00","description":"\nLibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in\ntif_lzw.c resulting in DoS or code execution via a crafted bmp image to\ntools/bmp2tiff.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"proposed patch in upstream bug\nbmp2tiff removed in recent versions\nwe will not be fixing this issue in precise/esm"}],"codename":null,"priority":"low","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-3606-1","https://www.cve.org/CVERecord?id=CVE-2017-5563"],"bugs":["http://bugzilla.maptools.org/show_bug.cgi?id=2664"],"patches":{"tiff":[]},"tags":{},"packages":[{"name":"tiff","source":"https://ubuntu.com/security/cve?package=tiff","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tiff","debian":"https://tracker.debian.org/pkg/tiff","statuses":[{"release_codename":"artful","status":"not-affected","description":"4.0.8-5","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"4.0.3-7ubuntu0.9","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"4.0.6-1ubuntu0.4","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":["USN-3606-1"],"notices":[{"id":"USN-3606-1","title":"LibTIFF vulnerabilities","summary":"LibTIFF could be made to crash or run programs as your login if it opened a\nspecially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2018-03-26T11:50:26.215438","description":"It was discovered that LibTIFF incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image, a remote attacker could crash the application, leading to a\ndenial of service, or possibly execute arbitrary code with user privileges.\n","is_hidden":false,"release_packages":{"artful":[{"name":"tiff","version":"4.0.8-5ubuntu0.1","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-tools","version":"4.0.8-5ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.8-5ubuntu0.1"},{"name":"libtiff5","version":"4.0.8-5ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.8-5ubuntu0.1"}],"trusty":[{"name":"tiff","version":"4.0.3-7ubuntu0.9","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-doc","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"},{"name":"libtiff-opengl","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"},{"name":"libtiff-tools","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"},{"name":"libtiff4-dev","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"},{"name":"libtiff5","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"},{"name":"libtiff5-alt-dev","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"},{"name":"libtiff5-dev","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"},{"name":"libtiffxx5","version":"4.0.3-7ubuntu0.9","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.3-7ubuntu0.9","pocket":"security"}],"xenial":[{"name":"tiff","version":"4.0.6-1ubuntu0.4","description":"Tag Image File Format (TIFF) library","is_source":true},{"name":"libtiff-doc","version":"4.0.6-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.4","pocket":"security"},{"name":"libtiff-opengl","version":"4.0.6-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.4","pocket":"security"},{"name":"libtiff-tools","version":"4.0.6-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.4","pocket":"security"},{"name":"libtiff5","version":"4.0.6-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.4","pocket":"security"},{"name":"libtiff5-dev","version":"4.0.6-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.4","pocket":"security"},{"name":"libtiffxx5","version":"4.0.6-1ubuntu0.4","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tiff","version_link":"https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.4","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2016-3186","CVE-2016-5102","CVE-2016-5318","CVE-2017-11613","CVE-2017-12944","CVE-2017-17095","CVE-2017-18013","CVE-2017-5563","CVE-2017-9117","CVE-2017-9147","CVE-2017-9935","CVE-2018-5784"]}]}],"offset":58720,"limit":20,"total_results":79316}