{"cves":[{"id":"CVE-2016-1018","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:51.024149+00:00","description":"\nStack-based buffer overflow in Adobe Flash Player before 18.0.0.343 and\n19.x through 21.x before 21.0.0.213 on Windows and OS X and before\n11.2.202.616 on Linux allows attackers to execute arbitrary code via\ncrafted JPEG-XR data.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","http://www.zerodayinitiative.com/advisories/ZDI-16-228/","https://www.cve.org/CVERecord?id=CVE-2016-1018"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1017","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:51.024149+00:00","description":"\nUse-after-free vulnerability in the LoadVars.decode function in Adobe Flash\nPlayer before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows\nand OS X and before 11.2.202.616 on Linux allows attackers to execute\narbitrary code via unspecified vectors, a different vulnerability than\nCVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1031.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","http://www.zerodayinitiative.com/advisories/ZDI-16-225/","https://www.cve.org/CVERecord?id=CVE-2016-1017"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1016","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:46.283068+00:00","description":"\nUse-after-free vulnerability in the Transform object implementation in\nAdobe Flash Player before 18.0.0.343 and 19.x through 21.x before\n21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows\nattackers to execute arbitrary code via a flash.geom.Matrix callback, a\ndifferent vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1017,\nand CVE-2016-1031.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","http://www.zerodayinitiative.com/advisories/ZDI-16-226/","https://www.cve.org/CVERecord?id=CVE-2016-1016"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1015","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:41.710493+00:00","description":"\nAdobe Flash Player before 18.0.0.343 and 19.x through 21.x before\n21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows\nattackers to execute arbitrary code by overriding NetConnection object\nproperties to leverage an unspecified \"type confusion,\" a different\nvulnerability than CVE-2016-1019.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","http://www.zerodayinitiative.com/advisories/ZDI-16-227/","https://www.cve.org/CVERecord?id=CVE-2016-1015"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1014","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:37.150045+00:00","description":"\nUntrusted search path vulnerability in Adobe Flash Player before 18.0.0.343\nand 19.x through 21.x before 21.0.0.213 on Windows and OS X and before\n11.2.202.616 on Linux allows local users to gain privileges via a Trojan\nhorse resource in an unspecified directory.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","https://www.cve.org/CVERecord?id=CVE-2016-1014"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1013","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:37.150045+00:00","description":"\nUse-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and\n19.x through 21.x before 21.0.0.213 on Windows and OS X and before\n11.2.202.616 on Linux allows attackers to execute arbitrary code via\nunspecified vectors, a different vulnerability than CVE-2016-1011,\nCVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","https://www.cve.org/CVERecord?id=CVE-2016-1013"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1012","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:32.645216+00:00","description":"\nAdobe Flash Player before 18.0.0.343 and 19.x through 21.x before\n21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows\nattackers to execute arbitrary code or cause a denial of service (memory\ncorruption) via unspecified vectors, a different vulnerability than\nCVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024,\nCVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,\nCVE-2016-1032, and CVE-2016-1033.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","https://www.cve.org/CVERecord?id=CVE-2016-1012"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1011","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:32.645216+00:00","description":"\nUse-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and\n19.x through 21.x before 21.0.0.213 on Windows and OS X and before\n11.2.202.616 on Linux allows attackers to execute arbitrary code via\nunspecified vectors, a different vulnerability than CVE-2016-1013,\nCVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","https://www.cve.org/CVERecord?id=CVE-2016-1011"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-1006","published":"2016-04-09T01:59:00","updated_at":"2025-08-25T21:52:18.321492+00:00","description":"\nAdobe Flash Player before 18.0.0.343 and 19.x through 21.x before\n21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows\nattackers to bypass the ASLR protection mechanism via JIT data.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","https://www.cve.org/CVERecord?id=CVE-2016-1006"],"bugs":[""],"patches":{"adobe-flashplugin":[],"flashplugin-nonfree":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"precise","status":"released","description":"1:20160407.1-0ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1:20160407.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1:20160407.1-0ubuntu0.15.10.1","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"precise","status":"released","description":"11.2.202.616ubuntu0.12.04.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"11.2.202.616ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.616","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"11.2.202.616ubuntu0.15.10.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-5969","published":"2016-04-08T15:59:00","updated_at":"2025-08-25T21:43:17.242745+00:00","description":"\nThe mysql-systemd-helper script in the mysql-community-server package\nbefore 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE\nLeap 42.1 and the mariadb package before 10.0.22-2.21.2 in openSUSE 13.2\nand before 10.0.22-3.1 in SUSE Linux Enterprise (SLE) 12.1 and openSUSE\nLeap 42.1 allows local users to discover database credentials by listing a\nprocess and its arguments.","ubuntu_description":"","notes":[{"author":"sbeattie","note":"looks to be SUSE specific"}],"codename":null,"priority":"low","cvss3":6.2,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://bugzilla.opensuse.org/show_bug.cgi?id=957174","https://www.cve.org/CVERecord?id=CVE-2015-5969"],"bugs":[""],"patches":{"mysql-5.5":[],"mysql-5.6":[],"mariadb-5.5":[],"mariadb-10.0":[],"percona-xtradb-cluster-5.5":[],"percona-xtradb-cluster-5.6":[],"percona-server-5.6":[]},"tags":{},"packages":[{"name":"mariadb-10.0","source":"https://ubuntu.com/security/cve?package=mariadb-10.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mariadb-10.0","debian":"https://tracker.debian.org/pkg/mariadb-10.0","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"}]},{"name":"mariadb-5.5","source":"https://ubuntu.com/security/cve?package=mariadb-5.5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mariadb-5.5","debian":"https://tracker.debian.org/pkg/mariadb-5.5","statuses":[{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [SUSE only]]","component":null,"pocket":"security"}]},{"name":"mysql-5.5","source":"https://ubuntu.com/security/cve?package=mysql-5.5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mysql-5.5","debian":"https://tracker.debian.org/pkg/mysql-5.5","statuses":[{"release_codename":"precise","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"mysql-5.6","source":"https://ubuntu.com/security/cve?package=mysql-5.6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mysql-5.6","debian":"https://tracker.debian.org/pkg/mysql-5.6","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [SUSE only]]","component":null,"pocket":"security"}]},{"name":"percona-server-5.6","source":"https://ubuntu.com/security/cve?package=percona-server-5.6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=percona-server-5.6","debian":"https://tracker.debian.org/pkg/percona-server-5.6","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"}]},{"name":"percona-xtradb-cluster-5.5","source":"https://ubuntu.com/security/cve?package=percona-xtradb-cluster-5.5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=percona-xtradb-cluster-5.5","debian":"https://tracker.debian.org/pkg/percona-xtradb-cluster-5.5","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [SUSE only]]","component":null,"pocket":"security"}]},{"name":"percona-xtradb-cluster-5.6","source":"https://ubuntu.com/security/cve?package=percona-xtradb-cluster-5.6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=percona-xtradb-cluster-5.6","debian":"https://tracker.debian.org/pkg/percona-xtradb-cluster-5.6","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"SUSE only","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-5229","published":"2016-04-08T15:59:00","updated_at":"2025-08-25T21:41:14.824585+00:00","description":"\nThe calloc function in the glibc package in Red Hat Enterprise Linux (RHEL)\n6.7 and 7.2 does not properly initialize memory areas, which might allow\ncontext-dependent attackers to cause a denial of service (hang or crash)\nvia unspecified vectors.","ubuntu_description":"","notes":[{"author":"seth-arnold","note":"This fault is in RHEL-specific code,"}],"codename":null,"priority":"high","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://bugzilla.redhat.com/attachment.cgi?id=1055966&action=diff","https://www.cve.org/CVERecord?id=CVE-2015-5229"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=1246713","https://bugzilla.novell.com/show_bug.cgi?id=CVE-2015-5229"],"patches":{"eglibc":[],"glibc":[]},"tags":{},"packages":[{"name":"eglibc","source":"https://ubuntu.com/security/cve?package=eglibc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=eglibc","debian":"https://tracker.debian.org/pkg/eglibc","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"glibc","source":"https://ubuntu.com/security/cve?package=glibc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=glibc","debian":"https://tracker.debian.org/pkg/glibc","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-3154","published":"2016-04-08T14:59:00","updated_at":"2025-08-26T11:54:05.517589+00:00","description":"\nThe encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x\nbefore 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote\nattackers to conduct PHP object injection attacks and execute arbitrary PHP\ncode via a crafted serialized object.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2016/03/15/2","https://www.cve.org/CVERecord?id=CVE-2016-3154"],"bugs":[""],"patches":{"spip":["upstream: https://core.spip.net/projects/spip/repository/revisions/22903"]},"tags":{},"packages":[{"name":"spip","source":"https://ubuntu.com/security/cve?package=spip","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=spip","debian":"https://tracker.debian.org/pkg/spip","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.0.22-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-3153","published":"2016-04-08T14:59:00","updated_at":"2025-08-26T11:54:05.517589+00:00","description":"\nSPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows\nremote attackers to execute arbitrary PHP code by adding content, related\nto the filtrer_entites function.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2016/03/15/2","https://www.cve.org/CVERecord?id=CVE-2016-3153"],"bugs":[""],"patches":{"spip":["upstream: https://core.spip.net/projects/spip/repository/revisions/22911"]},"tags":{},"packages":[{"name":"spip","source":"https://ubuntu.com/security/cve?package=spip","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=spip","debian":"https://tracker.debian.org/pkg/spip","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.0.22-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"3.1.1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-2563","published":"2016-04-07T23:59:00","updated_at":"2025-08-25T21:58:33.519995+00:00","description":"\nStack-based buffer overflow in the SCP command-line utility in PuTTY before\n0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial\nof service (stack memory corruption) or execute arbitrary code via a\ncrafted SCP-SINK file-size response to an SCP download request.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html","http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=commitdiff;h=bc6c15ab5f636e05b7e91883f0031a7e06117947","https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563","https://www.cve.org/CVERecord?id=CVE-2016-2563"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816921"],"patches":{"putty":["upstream: http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=commitdiff;h=bc6c15ab5f636e05b7e91883f0031a7e06117947"]},"tags":{},"packages":[{"name":"putty","source":"https://ubuntu.com/security/cve?package=putty","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=putty","debian":"https://tracker.debian.org/pkg/putty","statuses":[{"release_codename":"artful","status":"not-affected","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"0.67-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-2098","published":"2016-04-07T23:59:00","updated_at":"2025-08-25T21:56:31.525317+00:00","description":"\nAction Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and\n4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code\nby leveraging an application's unrestricted use of the render method.","ubuntu_description":"","notes":[{"author":"seth-arnold","note":"In Oneiric-Saucy, rails package is just for transition;\nThe rails package contains actual code from vivid onward"}],"codename":null,"priority":"medium","cvss3":7.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2016-2098"],"bugs":[""],"patches":{"rails":[],"ruby-rails-2.3":[],"ruby-actionpack-2.3":[],"ruby-activesupport-2.3":[],"ruby-activerecord-2.3":[],"ruby-rails-3.2":[],"ruby-actionpack-3.2":[],"ruby-activesupport-3.2":[],"ruby-activerecord-3.2":[],"ruby-activemodel-3.2":[],"rails-4.0":[]},"tags":{},"packages":[{"name":"rails","source":"https://ubuntu.com/security/cve?package=rails","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rails","debian":"https://tracker.debian.org/pkg/rails","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"contains no code","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [contains no code]","component":null,"pocket":"security"}]},{"name":"rails-4.0","source":"https://ubuntu.com/security/cve?package=rails-4.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rails-4.0","debian":"https://tracker.debian.org/pkg/rails-4.0","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"ruby-actionpack-2.3","source":"https://ubuntu.com/security/cve?package=ruby-actionpack-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-actionpack-2.3","debian":"https://tracker.debian.org/pkg/ruby-actionpack-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-actionpack-3.2","source":"https://ubuntu.com/security/cve?package=ruby-actionpack-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-actionpack-3.2","debian":"https://tracker.debian.org/pkg/ruby-actionpack-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"ruby-activemodel-3.2","source":"https://ubuntu.com/security/cve?package=ruby-activemodel-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activemodel-3.2","debian":"https://tracker.debian.org/pkg/ruby-activemodel-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected","component":null,"pocket":"security"}]},{"name":"ruby-activerecord-2.3","source":"https://ubuntu.com/security/cve?package=ruby-activerecord-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activerecord-2.3","debian":"https://tracker.debian.org/pkg/ruby-activerecord-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-activerecord-3.2","source":"https://ubuntu.com/security/cve?package=ruby-activerecord-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activerecord-3.2","debian":"https://tracker.debian.org/pkg/ruby-activerecord-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [code not present]","component":null,"pocket":"security"}]},{"name":"ruby-activesupport-2.3","source":"https://ubuntu.com/security/cve?package=ruby-activesupport-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activesupport-2.3","debian":"https://tracker.debian.org/pkg/ruby-activesupport-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-activesupport-3.2","source":"https://ubuntu.com/security/cve?package=ruby-activesupport-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activesupport-3.2","debian":"https://tracker.debian.org/pkg/ruby-activesupport-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [code not present]","component":null,"pocket":"security"}]},{"name":"ruby-rails-2.3","source":"https://ubuntu.com/security/cve?package=ruby-rails-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-rails-2.3","debian":"https://tracker.debian.org/pkg/ruby-rails-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-rails-3.2","source":"https://ubuntu.com/security/cve?package=ruby-rails-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-rails-3.2","debian":"https://tracker.debian.org/pkg/ruby-rails-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-2097","published":"2016-04-07T23:59:00","updated_at":"2025-08-25T21:56:26.722482+00:00","description":"\nDirectory traversal vulnerability in Action View in Ruby on Rails before\n3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary\nfiles by leveraging an application's unrestricted use of the render method\nand providing a .. (dot dot) in a pathname.  NOTE: this vulnerability\nexists because of an incomplete fix for CVE-2016-0752.","ubuntu_description":"","notes":[{"author":"seth-arnold","note":"In Oneiric-Saucy, rails package is just for transition;\nThe rails package contains actual code from vivid onward"}],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2016-2097"],"bugs":[""],"patches":{"rails":[],"ruby-rails-2.3":[],"ruby-actionpack-2.3":[],"ruby-activesupport-2.3":[],"ruby-activerecord-2.3":[],"ruby-rails-3.2":[],"ruby-actionpack-3.2":[],"ruby-activesupport-3.2":[],"ruby-activerecord-3.2":[],"ruby-activemodel-3.2":[],"rails-4.0":[]},"tags":{},"packages":[{"name":"rails","source":"https://ubuntu.com/security/cve?package=rails","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rails","debian":"https://tracker.debian.org/pkg/rails","statuses":[{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"contains no code","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2:4.2.5.2-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [contains no code]","component":null,"pocket":"security"}]},{"name":"rails-4.0","source":"https://ubuntu.com/security/cve?package=rails-4.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rails-4.0","debian":"https://tracker.debian.org/pkg/rails-4.0","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"ruby-actionpack-2.3","source":"https://ubuntu.com/security/cve?package=ruby-actionpack-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-actionpack-2.3","debian":"https://tracker.debian.org/pkg/ruby-actionpack-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-actionpack-3.2","source":"https://ubuntu.com/security/cve?package=ruby-actionpack-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-actionpack-3.2","debian":"https://tracker.debian.org/pkg/ruby-actionpack-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"ruby-activemodel-3.2","source":"https://ubuntu.com/security/cve?package=ruby-activemodel-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activemodel-3.2","debian":"https://tracker.debian.org/pkg/ruby-activemodel-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected","component":null,"pocket":"security"}]},{"name":"ruby-activerecord-2.3","source":"https://ubuntu.com/security/cve?package=ruby-activerecord-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activerecord-2.3","debian":"https://tracker.debian.org/pkg/ruby-activerecord-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-activerecord-3.2","source":"https://ubuntu.com/security/cve?package=ruby-activerecord-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activerecord-3.2","debian":"https://tracker.debian.org/pkg/ruby-activerecord-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [code not present]","component":null,"pocket":"security"}]},{"name":"ruby-activesupport-2.3","source":"https://ubuntu.com/security/cve?package=ruby-activesupport-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activesupport-2.3","debian":"https://tracker.debian.org/pkg/ruby-activesupport-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-activesupport-3.2","source":"https://ubuntu.com/security/cve?package=ruby-activesupport-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-activesupport-3.2","debian":"https://tracker.debian.org/pkg/ruby-activesupport-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [code not present]","component":null,"pocket":"security"}]},{"name":"ruby-rails-2.3","source":"https://ubuntu.com/security/cve?package=ruby-rails-2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-rails-2.3","debian":"https://tracker.debian.org/pkg/ruby-rails-2.3","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"ruby-rails-3.2","source":"https://ubuntu.com/security/cve?package=ruby-rails-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby-rails-3.2","debian":"https://tracker.debian.org/pkg/ruby-rails-3.2","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-0792","published":"2016-04-07T23:59:00","updated_at":"2025-08-25T21:51:10.517565+00:00","description":"\nMultiple unspecified API endpoints in Jenkins before 1.650 and LTS before\n1.642.2 allow remote authenticated users to execute arbitrary code via\nserialized data in an XML file, related to XStream and groovy.util.Expando.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24","https://www.cve.org/CVERecord?id=CVE-2016-0792"],"bugs":[""],"patches":{"jenkins":[]},"tags":{},"packages":[{"name":"jenkins","source":"https://ubuntu.com/security/cve?package=jenkins","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jenkins","debian":"https://tracker.debian.org/pkg/jenkins","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.650, 1.642.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-0791","published":"2016-04-07T23:59:00","updated_at":"2025-08-25T21:51:05.849887+00:00","description":"\nJenkins before 1.650 and LTS before 1.642.2 do not use a constant-time\nalgorithm to verify CSRF tokens, which makes it easier for remote attackers\nto bypass a CSRF protection mechanism via a brute-force approach.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24","https://www.cve.org/CVERecord?id=CVE-2016-0791"],"bugs":[""],"patches":{"jenkins":[]},"tags":{},"packages":[{"name":"jenkins","source":"https://ubuntu.com/security/cve?package=jenkins","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jenkins","debian":"https://tracker.debian.org/pkg/jenkins","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.650, 1.642.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-0790","published":"2016-04-07T23:59:00","updated_at":"2025-08-25T21:51:05.849887+00:00","description":"\nJenkins before 1.650 and LTS before 1.642.2 do not use a constant-time\nalgorithm to verify API tokens, which makes it easier for remote attackers\nto determine API tokens via a brute-force approach.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24","https://www.cve.org/CVERecord?id=CVE-2016-0790"],"bugs":[""],"patches":{"jenkins":[]},"tags":{},"packages":[{"name":"jenkins","source":"https://ubuntu.com/security/cve?package=jenkins","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jenkins","debian":"https://tracker.debian.org/pkg/jenkins","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.650, 1.642.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-0789","published":"2016-04-07T23:59:00","updated_at":"2025-08-25T21:51:05.849887+00:00","description":"\nCRLF injection vulnerability in the CLI command documentation in Jenkins\nbefore 1.650 and LTS before 1.642.2 allows remote attackers to inject\narbitrary HTTP headers and conduct HTTP response splitting attacks via\nunspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24","https://www.cve.org/CVERecord?id=CVE-2016-0789"],"bugs":[""],"patches":{"jenkins":[]},"tags":{},"packages":[{"name":"jenkins","source":"https://ubuntu.com/security/cve?package=jenkins","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jenkins","debian":"https://tracker.debian.org/pkg/jenkins","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.650, 1.642.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":61280,"limit":20,"total_results":79316}