{"cves":[{"id":"CVE-2015-1323","published":"2015-06-16T17:00:00","updated_at":"2025-08-25T21:34:34.717648+00:00","description":"\nThe simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as\npackaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in\nUbuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS,\nbefore 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local\nusers to obtain sensitive information, or access files with root\npermissions.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-2648-1","https://www.cve.org/CVERecord?id=CVE-2015-1323"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/aptdaemon/+bug/1449587"],"patches":{"aptdaemon":[]},"tags":{},"packages":[{"name":"aptdaemon","source":"https://ubuntu.com/security/cve?package=aptdaemon","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=aptdaemon","debian":"https://tracker.debian.org/pkg/aptdaemon","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"0.43+bzr805-0ubuntu10","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.1.1-1ubuntu5.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.1.1+bzr980-0ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.1.1+bzr982-0ubuntu3.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-2648-1"],"notices":[{"id":"USN-2648-1","title":"Aptdaemon vulnerability","summary":"Aptdaemon could be made to expose sensitive information, or allow file\naccess as the administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n","references":[],"published":"2015-06-16T17:06:55.995372","description":"Tavis Ormandy discovered that Aptdeamon incorrectly handled the simulate\ndbus method. A local attacker could use this issue to possibly expose\nsensitive information, or perform other file access as the root user.\n","is_hidden":false,"release_packages":{"precise":[{"name":"aptdaemon","version":"0.43+bzr805-0ubuntu10","description":"transaction based package management service","is_source":true},{"name":"aptdaemon","version":"0.43+bzr805-0ubuntu10","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/0.43+bzr805-0ubuntu10"}],"trusty":[{"name":"aptdaemon","version":"1.1.1-1ubuntu5.2","description":"transaction based package management service","is_source":true},{"name":"aptdaemon","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"aptdaemon-data","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python-aptdaemon","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python-aptdaemon-gtk","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python-aptdaemon.gtk3widgets","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python-aptdaemon.gtkwidgets","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python3-aptdaemon","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python3-aptdaemon.gtk3widgets","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python3-aptdaemon.pkcompat","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"},{"name":"python3-aptdaemon.test","version":"1.1.1-1ubuntu5.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1-1ubuntu5.2","pocket":"security"}],"utopic":[{"name":"aptdaemon","version":"1.1.1+bzr980-0ubuntu1.1","description":"transaction based package management service","is_source":true},{"name":"aptdaemon","version":"1.1.1+bzr980-0ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1+bzr980-0ubuntu1.1"}],"vivid":[{"name":"aptdaemon","version":"1.1.1+bzr982-0ubuntu3.1","description":"transaction based package management service","is_source":true},{"name":"aptdaemon","version":"1.1.1+bzr982-0ubuntu3.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/aptdaemon","version_link":"https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1+bzr982-0ubuntu3.1"}]},"type":"USN","cves_ids":["CVE-2015-1323"]}]},{"id":"CVE-2015-3205","published":"2015-06-16T16:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nlibmimedir allows remote attackers to execute arbitrary code via a VCF file\nwith two NULL bytes at the end of the file, related to \"free\" function\ncalls in the \"lexer's memory clean-up procedure.\"","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.exploit-db.com/exploits/37249/","http://packetstormsecurity.com/files/132257/Libmimedir-VCF-Memory-Corruption-Proof-Of-Concept.html","https://www.cve.org/CVERecord?id=CVE-2015-3205"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=1222251"],"patches":{"libmimedir":[]},"tags":{},"packages":[{"name":"libmimedir","source":"https://ubuntu.com/security/cve?package=libmimedir","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmimedir","debian":"https://tracker.debian.org/pkg/libmimedir","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was needed]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3010","published":"2015-06-16T16:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nceph-deploy before 1.5.23 uses weak permissions (644) for\nceph/ceph.client.admin.keyring, which allows local users to obtain\nsensitive information by reading the file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/04/09/9","https://www.cve.org/CVERecord?id=CVE-2015-3010"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694013","https://bugzilla.suse.com/show_bug.cgi?id=920926"],"patches":{"ceph-deploy":["upstream: https://github.com/ceph/ceph-deploy/commit/eee56770393bf19ed2dd5389226c6190c08dee3f"]},"tags":{},"packages":[{"name":"ceph-deploy","source":"https://ubuntu.com/security/cve?package=ceph-deploy","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ceph-deploy","debian":"https://tracker.debian.org/pkg/ceph-deploy","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"1.5.32-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"1.5.32-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"1.5.32-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.5.23","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.5.32-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3395","published":"2015-06-16T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x\nbefore 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before\n2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers\nto have unspecified impact via a crafted image, related to a pixel pointer,\nwhich triggers an out-of-bounds array access.","ubuntu_description":"\nIt was discovered that Libav incorrectly handled certain media\nfiles. An attacker could possibly use this issue to cause a denial of\nservice or other unspecified impact.","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://ffmpeg.org/security.html","https://ubuntu.com/security/notices/USN-2944-1","https://www.cve.org/CVERecord?id=CVE-2015-3395"],"bugs":[""],"patches":{"chromium-browser":[],"oxide-qt":[],"libav":["upstream: https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948"],"ffmpeg":["upstream: https://github.com/FFmpeg/FFmpeg/commit/dfce316c12d867400fb132ff5094163e3d2634a3","upstream: https://github.com/FFmpeg/FFmpeg/commit/f7e1367f58263593e6cee3c282f7277d7ee9d553"]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"artful","status":"released","description":"47.0.2526.73-0ubuntu1.1218","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"47.0.2526.73-0ubuntu1.1218","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"released","description":"47.0.2526.73-0ubuntu1.1218","component":null,"pocket":"security"},{"release_codename":"disco","status":"released","description":"47.0.2526.73-0ubuntu1.1218","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"47.0.2526.73-0ubuntu0.14.04.1.1106","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"47.0.2526.73-0ubuntu0.15.04.1.1190","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"47.0.2526.73-0ubuntu0.15.10.1.1215","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"47.0.2526.73-0ubuntu1.1218","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"released","description":"47.0.2526.73-0ubuntu1.1218","component":null,"pocket":"security"},{"release_codename":"zesty","status":"released","description":"47.0.2526.73-0ubuntu1.1218","component":null,"pocket":"security"}]},{"name":"ffmpeg","source":"https://ubuntu.com/security/cve?package=ffmpeg","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ffmpeg","debian":"https://tracker.debian.org/pkg/ffmpeg","statuses":[{"release_codename":"artful","status":"not-affected","description":"7:2.8.3-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"7:2.8.3-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"7:2.8.3-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"7:2.8.3-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.5.6,2.6.2","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"7:2.5.6-0ubuntu0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"7:2.7.3-0ubuntu0.15.10.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"7:2.8.3-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"7:2.8.3-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"7:2.8.3-1","component":null,"pocket":"security"}]},{"name":"libav","source":"https://ubuntu.com/security/cve?package=libav","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libav","debian":"https://tracker.debian.org/pkg/libav","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"4:0.8.17-0ubuntu0.12.04.2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"6:9.20-0ubuntu0.14.04.1+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"11.4","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"oxide-qt","source":"https://ubuntu.com/security/cve?package=oxide-qt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=oxide-qt","debian":"https://tracker.debian.org/pkg/oxide-qt","statuses":[{"release_codename":"artful","status":"not-affected","description":"1.17.9-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"1.19.4","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.19.4-0ubuntu0.16.04.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"1.19.4-0ubuntu0.16.10.1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.17.9-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [1.19.4-0ubuntu0.14.04.1]","component":null,"pocket":"security"}]}],"notices_ids":["USN-2944-1"],"notices":[{"id":"USN-2944-1","title":"Libav vulnerabilities","summary":"Libav could be made to crash or run programs as your login if it opened a\nspecially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2016-04-04T18:05:42.042164","description":"It was discovered that Libav incorrectly handled certain malformed media\nfiles. If a user were tricked into opening a crafted media file, an\nattacker could cause a denial of service via application crash, or possibly\nexecute arbitrary code with the privileges of the user invoking the\nprogram.\n","is_hidden":false,"release_packages":{"precise":[{"name":"libav","version":"4:0.8.17-0ubuntu0.12.04.2","description":"Multimedia player, server, encoder and transcoder","is_source":true},{"name":"libavformat53","version":"4:0.8.17-0ubuntu0.12.04.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/libav","version_link":"https://launchpad.net/ubuntu/+source/libav/4:0.8.17-0ubuntu0.12.04.2"},{"name":"libavcodec53","version":"4:0.8.17-0ubuntu0.12.04.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/libav","version_link":"https://launchpad.net/ubuntu/+source/libav/4:0.8.17-0ubuntu0.12.04.2"}]},"type":"USN","cves_ids":["CVE-2014-8541","CVE-2015-1872","CVE-2015-3395","CVE-2015-5479","CVE-2015-6818","CVE-2015-6820","CVE-2015-6824","CVE-2015-6826","CVE-2015-8364","CVE-2015-8365","CVE-2016-1897","CVE-2016-1898","CVE-2016-2326","CVE-2016-2330"]}]},{"id":"CVE-2015-4164","published":"2015-06-15T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe compat_iret function in Xen 3.1 through 4.5 iterates the wrong way\nthrough a loop, which allows local 32-bit PV guest administrators to cause\na denial of service (large loop and system hang) via a hypercall_iret call\nwith EFLAGS.VM set.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://xenbits.xen.org/xsa/advisory-136.html","https://www.cve.org/CVERecord?id=CVE-2015-4164"],"bugs":[""],"patches":{"xen":[]},"tags":{"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"precise","status":"released","description":"4.1.6.1-0ubuntu0.12.04.6","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"4.4.2-0ubuntu0.14.04.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"4.5.0-1ubuntu4.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"4.5.1-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-4163","published":"2015-06-15T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nGNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant\ntable operation version, which allows local guest domains to cause a denial\nof service (NULL pointer dereference) via a hypercall without a\nGNTTABOP_setup_table or GNTTABOP_set_version.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://xenbits.xen.org/xsa/advisory-134.html","https://www.cve.org/CVERecord?id=CVE-2015-4163"],"bugs":[""],"patches":{"xen":[]},"tags":{"xen":["universe-binary"]},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"precise","status":"released","description":"4.1.6.1-0ubuntu0.12.04.6","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"4.4.2-0ubuntu0.14.04.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"4.5.0-1ubuntu4.2","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"4.5.1-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-1328","published":"2015-06-15T00:00:00","updated_at":"2025-08-25T21:34:34.717648+00:00","description":"\nThe overlayfs implementation in the linux (aka Linux kernel) package before\n3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions\nfor file creation in the upper filesystem directory, which allows local\nusers to obtain root access by leveraging a configuration in which\noverlayfs is permitted in an arbitrary mount namespace.","ubuntu_description":"\nPhilip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.","notes":[{"author":"tyhicks","note":"This CVE is specific to Ubuntu since Ubuntu allows overlayfs mounts\ninside of user namespaces"},{"author":"jdstrand","note":"android kernels (flo, goldfish, grouper, maguro, mako and manta) are\nnot supported on the Ubuntu Touch 14.10 and earlier preview kernels\nlinux-lts-saucy no longer receives official support\nlinux-lts-quantal no longer receives official support"}],"codename":null,"priority":"high","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-2640-1","https://ubuntu.com/security/notices/USN-2641-1","https://ubuntu.com/security/notices/USN-2642-1","https://ubuntu.com/security/notices/USN-2643-1","https://ubuntu.com/security/notices/USN-2644-1","https://ubuntu.com/security/notices/USN-2645-1","https://ubuntu.com/security/notices/USN-2646-1","https://ubuntu.com/security/notices/USN-2647-1","https://www.cve.org/CVERecord?id=CVE-2015-1328"],"bugs":["https://launchpad.net/bugs/1465400"],"patches":{"linux":["break-fix: local-2015-1328-break local-2015-1328-fix"],"linux-ec2":[],"linux-mvl-dove":[],"linux-ti-omap4":[],"linux-fsl-imx51":[],"linux-linaro-omap":[],"linux-linaro-shared":[],"linux-linaro-vexpress":[],"linux-qcm-msm":[],"linux-armadaxp":[],"linux-lts-quantal":[],"linux-lts-raring":[],"linux-lts-saucy":[],"linux-lts-trusty":[],"linux-goldfish":[],"linux-grouper":[],"linux-maguro":[],"linux-mako":[],"linux-manta":[],"linux-flo":[],"linux-lts-utopic":[],"linux-lts-vivid":[],"linux-lts-wily":[],"linux-raspi2":[],"linux-lts-xenial":[],"linux-snapdragon":[],"linux-aws":[],"linux-hwe-edge":[],"linux-hwe":[],"linux-gke":[]},"tags":{"linux-armadaxp":["not-ue"],"linux-lts-quantal":["not-ue"],"linux-lts-saucy":["not-ue"]},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"3.13.0-55.92","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"3.16.0-41.55","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"3.19.0-21.21","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"4.0.0-4.6","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-armadaxp","source":"https://ubuntu.com/security/cve?package=linux-armadaxp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-armadaxp","debian":"https://tracker.debian.org/pkg/linux-armadaxp","statuses":[{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-aws","source":"https://ubuntu.com/security/cve?package=linux-aws","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-aws","debian":"https://tracker.debian.org/pkg/linux-aws","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-ec2","source":"https://ubuntu.com/security/cve?package=linux-ec2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-ec2","debian":"https://tracker.debian.org/pkg/linux-ec2","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-flo","source":"https://ubuntu.com/security/cve?package=linux-flo","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-flo","debian":"https://tracker.debian.org/pkg/linux-flo","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was ignored","component":null,"pocket":"security"}]},{"name":"linux-fsl-imx51","source":"https://ubuntu.com/security/cve?package=linux-fsl-imx51","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-fsl-imx51","debian":"https://tracker.debian.org/pkg/linux-fsl-imx51","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-gke","source":"https://ubuntu.com/security/cve?package=linux-gke","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-gke","debian":"https://tracker.debian.org/pkg/linux-gke","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-goldfish","source":"https://ubuntu.com/security/cve?package=linux-goldfish","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-goldfish","debian":"https://tracker.debian.org/pkg/linux-goldfish","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was ignored","component":null,"pocket":"security"}]},{"name":"linux-grouper","source":"https://ubuntu.com/security/cve?package=linux-grouper","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-grouper","debian":"https://tracker.debian.org/pkg/linux-grouper","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was ignored","component":null,"pocket":"security"}]},{"name":"linux-hwe","source":"https://ubuntu.com/security/cve?package=linux-hwe","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-hwe","debian":"https://tracker.debian.org/pkg/linux-hwe","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-hwe-edge","source":"https://ubuntu.com/security/cve?package=linux-hwe-edge","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-hwe-edge","debian":"https://tracker.debian.org/pkg/linux-hwe-edge","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-linaro-omap","source":"https://ubuntu.com/security/cve?package=linux-linaro-omap","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-linaro-omap","debian":"https://tracker.debian.org/pkg/linux-linaro-omap","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-linaro-shared","source":"https://ubuntu.com/security/cve?package=linux-linaro-shared","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-linaro-shared","debian":"https://tracker.debian.org/pkg/linux-linaro-shared","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-linaro-vexpress","source":"https://ubuntu.com/security/cve?package=linux-linaro-vexpress","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-linaro-vexpress","debian":"https://tracker.debian.org/pkg/linux-linaro-vexpress","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-quantal","source":"https://ubuntu.com/security/cve?package=linux-lts-quantal","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-quantal","debian":"https://tracker.debian.org/pkg/linux-lts-quantal","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-raring","source":"https://ubuntu.com/security/cve?package=linux-lts-raring","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-raring","debian":"https://tracker.debian.org/pkg/linux-lts-raring","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-saucy","source":"https://ubuntu.com/security/cve?package=linux-lts-saucy","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-saucy","debian":"https://tracker.debian.org/pkg/linux-lts-saucy","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-trusty","source":"https://ubuntu.com/security/cve?package=linux-lts-trusty","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-trusty","debian":"https://tracker.debian.org/pkg/linux-lts-trusty","statuses":[{"release_codename":"precise","status":"released","description":"3.13.0-55.92~precise1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-utopic","source":"https://ubuntu.com/security/cve?package=linux-lts-utopic","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-utopic","debian":"https://tracker.debian.org/pkg/linux-lts-utopic","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"3.16.0-41.55~14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-vivid","source":"https://ubuntu.com/security/cve?package=linux-lts-vivid","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-vivid","debian":"https://tracker.debian.org/pkg/linux-lts-vivid","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"3.19.0-21.21~14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-wily","source":"https://ubuntu.com/security/cve?package=linux-lts-wily","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-wily","debian":"https://tracker.debian.org/pkg/linux-lts-wily","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected","component":null,"pocket":"security"}]},{"name":"linux-lts-xenial","source":"https://ubuntu.com/security/cve?package=linux-lts-xenial","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-xenial","debian":"https://tracker.debian.org/pkg/linux-lts-xenial","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-maguro","source":"https://ubuntu.com/security/cve?package=linux-maguro","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-maguro","debian":"https://tracker.debian.org/pkg/linux-maguro","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was ignored","component":null,"pocket":"security"}]},{"name":"linux-mako","source":"https://ubuntu.com/security/cve?package=linux-mako","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-mako","debian":"https://tracker.debian.org/pkg/linux-mako","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was ignored","component":null,"pocket":"security"}]},{"name":"linux-manta","source":"https://ubuntu.com/security/cve?package=linux-manta","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-manta","debian":"https://tracker.debian.org/pkg/linux-manta","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was ignored","component":null,"pocket":"security"}]},{"name":"linux-mvl-dove","source":"https://ubuntu.com/security/cve?package=linux-mvl-dove","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-mvl-dove","debian":"https://tracker.debian.org/pkg/linux-mvl-dove","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-qcm-msm","source":"https://ubuntu.com/security/cve?package=linux-qcm-msm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-qcm-msm","debian":"https://tracker.debian.org/pkg/linux-qcm-msm","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-raspi2","source":"https://ubuntu.com/security/cve?package=linux-raspi2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-raspi2","debian":"https://tracker.debian.org/pkg/linux-raspi2","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-snapdragon","source":"https://ubuntu.com/security/cve?package=linux-snapdragon","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-snapdragon","debian":"https://tracker.debian.org/pkg/linux-snapdragon","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-ti-omap4","source":"https://ubuntu.com/security/cve?package=linux-ti-omap4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-ti-omap4","debian":"https://tracker.debian.org/pkg/linux-ti-omap4","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-2646-1","USN-2647-1","USN-2640-1","USN-2645-1","USN-2644-1","USN-2642-1","USN-2643-1","USN-2641-1"],"notices":[{"id":"USN-2646-1","title":"Linux kernel vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T21:59:33.863154","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"utopic":[{"name":"linux","version":"3.16.0-41.55","description":"Linux kernel","is_source":true},{"name":"linux-image-3.16.0-41-powerpc-smp","version":"3.16.0-41.55","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.16.0-41.55"},{"name":"linux-image-3.16.0-41-powerpc64-smp","version":"3.16.0-41.55","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.16.0-41.55"},{"name":"linux-image-3.16.0-41-powerpc64-emb","version":"3.16.0-41.55","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.16.0-41.55"},{"name":"linux-image-3.16.0-41-powerpc-e500mc","version":"3.16.0-41.55","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.16.0-41.55"},{"name":"linux-image-3.16.0-41-generic-lpae","version":"3.16.0-41.55","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.16.0-41.55"},{"name":"linux-image-3.16.0-41-lowlatency","version":"3.16.0-41.55","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.16.0-41.55"},{"name":"linux-image-3.16.0-41-generic","version":"3.16.0-41.55","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.16.0-41.55"}]},"type":"USN","cves_ids":["CVE-2015-1328"]},{"id":"USN-2647-1","title":"Linux kernel vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T22:01:59.434545","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"vivid":[{"name":"linux","version":"3.19.0-21.21","description":"Linux kernel","is_source":true},{"name":"linux-image-3.19.0-21-powerpc-e500mc","version":"3.19.0-21.21","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.19.0-21.21"},{"name":"linux-image-3.19.0-21-powerpc-smp","version":"3.19.0-21.21","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.19.0-21.21"},{"name":"linux-image-3.19.0-21-powerpc64-smp","version":"3.19.0-21.21","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.19.0-21.21"},{"name":"linux-image-3.19.0-21-powerpc64-emb","version":"3.19.0-21.21","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.19.0-21.21"},{"name":"linux-image-3.19.0-21-lowlatency","version":"3.19.0-21.21","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.19.0-21.21"},{"name":"linux-image-3.19.0-21-generic","version":"3.19.0-21.21","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.19.0-21.21"},{"name":"linux-image-3.19.0-21-generic-lpae","version":"3.19.0-21.21","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.19.0-21.21"}]},"type":"USN","cves_ids":["CVE-2015-1328"]},{"id":"USN-2640-1","title":"Linux kernel vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T21:37:47.748996","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"precise":[{"name":"linux","version":"3.2.0-86.123","description":"Linux kernel","is_source":true},{"name":"linux-image-3.2.0-86-generic-pae","version":"3.2.0-86.123","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.2.0-86.123"},{"name":"linux-image-3.2.0-86-powerpc64-smp","version":"3.2.0-86.123","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.2.0-86.123"},{"name":"linux-image-3.2.0-86-generic","version":"3.2.0-86.123","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.2.0-86.123"},{"name":"linux-image-3.2.0-86-virtual","version":"3.2.0-86.123","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.2.0-86.123"},{"name":"linux-image-3.2.0-86-omap","version":"3.2.0-86.123","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.2.0-86.123"},{"name":"linux-image-3.2.0-86-powerpc-smp","version":"3.2.0-86.123","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.2.0-86.123"},{"name":"linux-image-3.2.0-86-highbank","version":"3.2.0-86.123","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.2.0-86.123"}]},"type":"USN","cves_ids":["CVE-2015-1328"]},{"id":"USN-2645-1","title":"Linux kernel (Vivid HWE) vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T21:57:00.988840","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"linux-lts-vivid","version":"3.19.0-21.21~14.04.1","description":"Linux hardware enablement kernel from Vivid","is_source":true},{"name":"linux-image-3.19.0-21-generic","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"},{"name":"linux-image-3.19.0-21-generic-lpae","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"},{"name":"linux-image-3.19.0-21-lowlatency","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"},{"name":"linux-image-3.19.0-21-powerpc-e500mc","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"},{"name":"linux-image-3.19.0-21-powerpc-smp","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"},{"name":"linux-image-3.19.0-21-powerpc64-emb","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"},{"name":"linux-image-3.19.0-21-powerpc64-smp","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"},{"name":"linux-image-extra-3.19.0-21-generic","version":"3.19.0-21.21~14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-21.21~14.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2015-1328"]},{"id":"USN-2644-1","title":"Linux kernel (Utopic HWE) vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T21:54:36.333219","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"linux-lts-utopic","version":"3.16.0-41.55~14.04.1","description":"Linux hardware enablement kernel from Utopic","is_source":true},{"name":"linux-image-3.16.0-41-generic","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"},{"name":"linux-image-3.16.0-41-generic-lpae","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"},{"name":"linux-image-3.16.0-41-lowlatency","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"},{"name":"linux-image-3.16.0-41-powerpc-e500mc","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"},{"name":"linux-image-3.16.0-41-powerpc-smp","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"},{"name":"linux-image-3.16.0-41-powerpc64-emb","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"},{"name":"linux-image-3.16.0-41-powerpc64-smp","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"},{"name":"linux-image-extra-3.16.0-41-generic","version":"3.16.0-41.55~14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-41.55~14.04.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2015-1328"]},{"id":"USN-2642-1","title":"Linux kernel (Trusty HWE) vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T21:44:51.661326","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"precise":[{"name":"linux-lts-trusty","version":"3.13.0-55.92~precise1","description":"Linux hardware enablement kernel from Trusty","is_source":true},{"name":"linux-image-3.13.0-55-generic-lpae","version":"3.13.0-55.92~precise1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-trusty","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-trusty/3.13.0-55.92~precise1"},{"name":"linux-image-3.13.0-55-generic","version":"3.13.0-55.92~precise1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-lts-trusty","version_link":"https://launchpad.net/ubuntu/+source/linux-lts-trusty/3.13.0-55.92~precise1"}]},"type":"USN","cves_ids":["CVE-2015-1328"]},{"id":"USN-2643-1","title":"Linux kernel vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T21:47:26.405430","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"trusty":[{"name":"linux","version":"3.13.0-55.92","description":"Linux kernel","is_source":true},{"name":"linux-image-3.13.0-55-generic","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-3.13.0-55-generic-lpae","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-3.13.0-55-lowlatency","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-3.13.0-55-powerpc-e500","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-3.13.0-55-powerpc-e500mc","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-3.13.0-55-powerpc-smp","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-3.13.0-55-powerpc64-emb","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-3.13.0-55-powerpc64-smp","version":"3.13.0-55.92","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"},{"name":"linux-image-extra-3.13.0-55-generic","version":"3.13.0-55.92","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/3.13.0-55.92","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2015-1328"]},{"id":"USN-2641-1","title":"Linux kernel (OMAP4) vulnerability","summary":"The system could be made to run programs as an administrator.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2015-06-15T21:41:46.497484","description":"Philip Pettersson discovered a privilege escalation when using overlayfs\nmounts inside of user namespaces. A local user could exploit this flaw to\ngain administrative privileges on the system.\n","is_hidden":false,"release_packages":{"precise":[{"name":"linux-ti-omap4","version":"3.2.0-1466.86","description":"Linux kernel for OMAP4","is_source":true},{"name":"linux-image-3.2.0-1466-omap4","version":"3.2.0-1466.86","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-ti-omap4","version_link":"https://launchpad.net/ubuntu/+source/linux-ti-omap4/3.2.0-1466.86"}]},"type":"USN","cves_ids":["CVE-2015-1328"]}]},{"id":"CVE-2015-4472","published":"2015-06-11T14:59:00","updated_at":"2025-10-01T23:17:12.695119+00:00","description":"\nOff-by-one error in the READ_ENCINT macro in chmd.c in libmspack before 0.5\nallows remote attackers to cause a denial of service (application crash) or\npossibly have unspecified other impact via a crafted CHM file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/02/03/11","https://bugs.debian.org/775687","http://openwall.com/lists/oss-security/2015/02/03/11","https://www.cve.org/CVERecord?id=CVE-2015-4472","https://ubuntu.com/security/notices/USN-7788-1"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775687"],"patches":{"libmspack":[]},"tags":{},"packages":[{"name":"libmspack","source":"https://ubuntu.com/security/cve?package=libmspack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmspack","debian":"https://tracker.debian.org/pkg/libmspack","statuses":[{"release_codename":"vivid","status":"not-affected","description":"0.5-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.4-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4-1ubuntu0.1~esm2","component":null,"pocket":"esm-infra-legacy"}]}],"notices_ids":["USN-7788-1"],"notices":[{"id":"USN-7788-1","title":"libmspack vulnerabilities","summary":"Several security issues were fixed in libmspack.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-10-01T00:06:41.235654","description":"Jakub Wilk discovered that libmspack did not correctly handle certain\ninteger operations and bounds checking. A remote attacker could possibly\nuse this issue to cause a denial of service. (CVE-2015-4467, CVE-2015-4468,\nCVE-2015-4469, CVE-2015-4472)\n\nIt was discovered that libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2017-11423)\n\nIt was discovered that libmspack incorrectly handled certain malformed CHM\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2017-6419)\n\nHanno Böck discovered that libmspack incorrectly handled certain CHM files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2018-14679, CVE-2018-14680)\n\nJakub Wilk discovered that libmspack incorrectly handled certain KWAJ\nfiles. An attacker could possibly use this issue to execute arbitrary code.\n(CVE-2018-14681)\n\nDmitry Glavatskikh discovered that libmspack incorrectly handled certain\nCHM files. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2018-14682)\n\nIt was discovered libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2018-18585)\n\nIt was discovered that libmspack incorrectly handled certain CHM files. A\nremote attacker could possibly use this issue to access sensitive\ninformation. (CVE-2019-1010305)","is_hidden":false,"release_packages":{"trusty":[{"name":"libmspack","version":"0.4-1ubuntu0.1~esm2","description":"library for Microsoft compression formats","is_source":true},{"name":"libmspack-dev","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack-doc","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack0","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"}]},"type":"USN","cves_ids":["CVE-2018-14679","CVE-2018-14681","CVE-2015-4468","CVE-2018-14682","CVE-2017-6419","CVE-2015-4469","CVE-2018-18585","CVE-2018-14680","CVE-2019-1010305","CVE-2015-4472","CVE-2015-4467","CVE-2017-11423"]}]},{"id":"CVE-2015-4471","published":"2015-06-11T14:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nOff-by-one error in the lzxd_decompress function in lzxd.c in libmspack\nbefore 0.5 allows remote attackers to cause a denial of service (buffer\nunder-read and application crash) via a crafted CAB archive.","ubuntu_description":"\nIt was discovered that cabextract incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause cabextract to crash,\nresulting in a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/02/03/11","https://github.com/kyz/libmspack/commit/18b6a2cc0b87536015bedd4f7763e6b02d5aa4f3","https://bugs.debian.org/775499","http://openwall.com/lists/oss-security/2015/02/03/11","https://www.cve.org/CVERecord?id=CVE-2015-4471"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775499"],"patches":{"libmspack":[],"cabextract":[]},"tags":{},"packages":[{"name":"cabextract","source":"https://ubuntu.com/security/cve?package=cabextract","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=cabextract","debian":"https://tracker.debian.org/pkg/cabextract","statuses":[{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.4-4ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"1.6-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"libmspack","source":"https://ubuntu.com/security/cve?package=libmspack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmspack","debian":"https://tracker.debian.org/pkg/libmspack","statuses":[{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"0.4-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"0.5-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-4470","published":"2015-06-11T14:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nOff-by-one error in the inflate function in mszipd.c in libmspack before\n0.5 allows remote attackers to cause a denial of service (buffer over-read\nand application crash) via a crafted CAB archive.","ubuntu_description":"\nIt was discovered that cabextract incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause cabextract to crash,\nresulting in a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/02/03/11","https://bugs.debian.org/775498","http://openwall.com/lists/oss-security/2015/02/03/11","https://www.cve.org/CVERecord?id=CVE-2015-4470"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775498"],"patches":{"libmspack":[],"cabextract":[]},"tags":{},"packages":[{"name":"cabextract","source":"https://ubuntu.com/security/cve?package=cabextract","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=cabextract","debian":"https://tracker.debian.org/pkg/cabextract","statuses":[{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.4-4ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"1.6-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"libmspack","source":"https://ubuntu.com/security/cve?package=libmspack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmspack","debian":"https://tracker.debian.org/pkg/libmspack","statuses":[{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"0.4-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"0.5-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-4469","published":"2015-06-11T14:59:00","updated_at":"2025-10-01T23:17:08.746663+00:00","description":"\nThe chmd_read_headers function in chmd.c in libmspack before 0.5 does not\nvalidate name lengths, which allows remote attackers to cause a denial of\nservice (buffer over-read and application crash) via a crafted CHM file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/02/03/11","https://bugs.debian.org/774726","http://openwall.com/lists/oss-security/2015/02/03/11","http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-name-field-boundaries.patch?id=a25bb144795e526748b57884daf365732c7e2295","https://www.cve.org/CVERecord?id=CVE-2015-4469","https://ubuntu.com/security/notices/USN-7788-1"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774726"],"patches":{"libmspack":[]},"tags":{},"packages":[{"name":"libmspack","source":"https://ubuntu.com/security/cve?package=libmspack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmspack","debian":"https://tracker.debian.org/pkg/libmspack","statuses":[{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.4-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"0.5-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4-1ubuntu0.1~esm2","component":null,"pocket":"esm-infra-legacy"}]}],"notices_ids":["USN-7788-1"],"notices":[{"id":"USN-7788-1","title":"libmspack vulnerabilities","summary":"Several security issues were fixed in libmspack.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-10-01T00:06:41.235654","description":"Jakub Wilk discovered that libmspack did not correctly handle certain\ninteger operations and bounds checking. A remote attacker could possibly\nuse this issue to cause a denial of service. (CVE-2015-4467, CVE-2015-4468,\nCVE-2015-4469, CVE-2015-4472)\n\nIt was discovered that libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2017-11423)\n\nIt was discovered that libmspack incorrectly handled certain malformed CHM\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2017-6419)\n\nHanno Böck discovered that libmspack incorrectly handled certain CHM files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2018-14679, CVE-2018-14680)\n\nJakub Wilk discovered that libmspack incorrectly handled certain KWAJ\nfiles. An attacker could possibly use this issue to execute arbitrary code.\n(CVE-2018-14681)\n\nDmitry Glavatskikh discovered that libmspack incorrectly handled certain\nCHM files. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2018-14682)\n\nIt was discovered libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2018-18585)\n\nIt was discovered that libmspack incorrectly handled certain CHM files. A\nremote attacker could possibly use this issue to access sensitive\ninformation. (CVE-2019-1010305)","is_hidden":false,"release_packages":{"trusty":[{"name":"libmspack","version":"0.4-1ubuntu0.1~esm2","description":"library for Microsoft compression formats","is_source":true},{"name":"libmspack-dev","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack-doc","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack0","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"}]},"type":"USN","cves_ids":["CVE-2018-14679","CVE-2018-14681","CVE-2015-4468","CVE-2018-14682","CVE-2017-6419","CVE-2015-4469","CVE-2018-18585","CVE-2018-14680","CVE-2019-1010305","CVE-2015-4472","CVE-2015-4467","CVE-2017-11423"]}]},{"id":"CVE-2015-4468","published":"2015-06-11T14:59:00","updated_at":"2025-10-01T23:17:08.746663+00:00","description":"\nMultiple integer overflows in the search_chunk function in chmd.c in\nlibmspack before 0.5 allow remote attackers to cause a denial of service\n(buffer over-read and application crash) via a crafted CHM file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/02/03/11","https://bugs.debian.org/774726","http://openwall.com/lists/oss-security/2015/02/03/11","http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-pointer-arithmetic-overflow.patch?id=a25bb144795e526748b57884daf365732c7e2295","https://www.cve.org/CVERecord?id=CVE-2015-4468","https://ubuntu.com/security/notices/USN-7788-1"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774726"],"patches":{"libmspack":[]},"tags":{},"packages":[{"name":"libmspack","source":"https://ubuntu.com/security/cve?package=libmspack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmspack","debian":"https://tracker.debian.org/pkg/libmspack","statuses":[{"release_codename":"vivid","status":"not-affected","description":"0.5-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.4-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4-1ubuntu0.1~esm2","component":null,"pocket":"esm-infra-legacy"}]}],"notices_ids":["USN-7788-1"],"notices":[{"id":"USN-7788-1","title":"libmspack vulnerabilities","summary":"Several security issues were fixed in libmspack.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-10-01T00:06:41.235654","description":"Jakub Wilk discovered that libmspack did not correctly handle certain\ninteger operations and bounds checking. A remote attacker could possibly\nuse this issue to cause a denial of service. (CVE-2015-4467, CVE-2015-4468,\nCVE-2015-4469, CVE-2015-4472)\n\nIt was discovered that libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2017-11423)\n\nIt was discovered that libmspack incorrectly handled certain malformed CHM\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2017-6419)\n\nHanno Böck discovered that libmspack incorrectly handled certain CHM files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2018-14679, CVE-2018-14680)\n\nJakub Wilk discovered that libmspack incorrectly handled certain KWAJ\nfiles. An attacker could possibly use this issue to execute arbitrary code.\n(CVE-2018-14681)\n\nDmitry Glavatskikh discovered that libmspack incorrectly handled certain\nCHM files. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2018-14682)\n\nIt was discovered libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2018-18585)\n\nIt was discovered that libmspack incorrectly handled certain CHM files. A\nremote attacker could possibly use this issue to access sensitive\ninformation. (CVE-2019-1010305)","is_hidden":false,"release_packages":{"trusty":[{"name":"libmspack","version":"0.4-1ubuntu0.1~esm2","description":"library for Microsoft compression formats","is_source":true},{"name":"libmspack-dev","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack-doc","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack0","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"}]},"type":"USN","cves_ids":["CVE-2018-14679","CVE-2018-14681","CVE-2015-4468","CVE-2018-14682","CVE-2017-6419","CVE-2015-4469","CVE-2018-18585","CVE-2018-14680","CVE-2019-1010305","CVE-2015-4472","CVE-2015-4467","CVE-2017-11423"]}]},{"id":"CVE-2015-4467","published":"2015-06-11T14:59:00","updated_at":"2025-10-01T23:17:12.695119+00:00","description":"\nThe chmd_init_decomp function in chmd.c in libmspack before 0.5 does not\nproperly validate the reset interval, which allows remote attackers to\ncause a denial of service (divide-by-zero error and application crash) via\na crafted CHM file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/02/03/11","https://bugs.debian.org/774725","http://openwall.com/lists/oss-security/2015/02/03/11","http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-division-by-zero.patch?id=a25bb144795e526748b57884daf365732c7e2295","https://www.cve.org/CVERecord?id=CVE-2015-4467","https://ubuntu.com/security/notices/USN-7788-1"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774725"],"patches":{"libmspack":[]},"tags":{},"packages":[{"name":"libmspack","source":"https://ubuntu.com/security/cve?package=libmspack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmspack","debian":"https://tracker.debian.org/pkg/libmspack","statuses":[{"release_codename":"vivid","status":"not-affected","description":"0.5-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.4-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4-1ubuntu0.1~esm2","component":null,"pocket":"esm-infra-legacy"}]}],"notices_ids":["USN-7788-1"],"notices":[{"id":"USN-7788-1","title":"libmspack vulnerabilities","summary":"Several security issues were fixed in libmspack.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2025-10-01T00:06:41.235654","description":"Jakub Wilk discovered that libmspack did not correctly handle certain\ninteger operations and bounds checking. A remote attacker could possibly\nuse this issue to cause a denial of service. (CVE-2015-4467, CVE-2015-4468,\nCVE-2015-4469, CVE-2015-4472)\n\nIt was discovered that libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2017-11423)\n\nIt was discovered that libmspack incorrectly handled certain malformed CHM\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2017-6419)\n\nHanno Böck discovered that libmspack incorrectly handled certain CHM files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2018-14679, CVE-2018-14680)\n\nJakub Wilk discovered that libmspack incorrectly handled certain KWAJ\nfiles. An attacker could possibly use this issue to execute arbitrary code.\n(CVE-2018-14681)\n\nDmitry Glavatskikh discovered that libmspack incorrectly handled certain\nCHM files. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2018-14682)\n\nIt was discovered libmspack incorrectly handled certain malformed CAB\nfiles. A remote attacker could use this issue to cause libmspack to crash,\nresulting in a denial of service. (CVE-2018-18585)\n\nIt was discovered that libmspack incorrectly handled certain CHM files. A\nremote attacker could possibly use this issue to access sensitive\ninformation. (CVE-2019-1010305)","is_hidden":false,"release_packages":{"trusty":[{"name":"libmspack","version":"0.4-1ubuntu0.1~esm2","description":"library for Microsoft compression formats","is_source":true},{"name":"libmspack-dev","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack-doc","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"},{"name":"libmspack0","version":"0.4-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libmspack","version_link":null,"pocket":"esm-infra-legacy"}]},"type":"USN","cves_ids":["CVE-2018-14679","CVE-2018-14681","CVE-2015-4468","CVE-2018-14682","CVE-2017-6419","CVE-2015-4469","CVE-2018-18585","CVE-2018-14680","CVE-2019-1010305","CVE-2015-4472","CVE-2015-4467","CVE-2017-11423"]}]},{"id":"CVE-2014-9732","published":"2015-06-11T14:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe cabd_extract function in cabd.c in libmspack before 0.5 does not\nproperly maintain decompression callbacks in certain cases where an invalid\nfile follows a valid file, which allows remote attackers to cause a denial\nof service (NULL pointer dereference and application crash) via a crafted\nCAB archive.","ubuntu_description":"\nIt was discovered that cabextract incorrectly handled certain malformed CAB\nfiles. An attacker could use this issue to cause cabextract to crash,\nresulting in a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/02/03/11","https://bugs.debian.org/774665","http://openwall.com/lists/oss-security/2015/02/03/11","https://www.cve.org/CVERecord?id=CVE-2014-9732"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774665"],"patches":{"libmspack":[],"cabextract":[]},"tags":{},"packages":[{"name":"cabextract","source":"https://ubuntu.com/security/cve?package=cabextract","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=cabextract","debian":"https://tracker.debian.org/pkg/cabextract","statuses":[{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.4-4ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"libmspack","source":"https://ubuntu.com/security/cve?package=libmspack","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libmspack","debian":"https://tracker.debian.org/pkg/libmspack","statuses":[{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.5-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"0.5-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.4-1ubuntu0.1~esm1","component":null,"pocket":"esm-infra"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-1792","published":"2015-06-11T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before\n0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b\nallows remote attackers to cause a denial of service (infinite loop) via\nvectors that trigger a NULL value of a BIO data structure, as demonstrated\nby an unrecognized X.660 OID for a hash function.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.openssl.org/news/secadv_20150611.txt","https://ubuntu.com/security/notices/USN-2639-1","https://www.cve.org/CVERecord?id=CVE-2015-1792"],"bugs":[""],"patches":{"openssl":[],"openssl098":[]},"tags":{},"packages":[{"name":"openssl","source":"https://ubuntu.com/security/cve?package=openssl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl","debian":"https://tracker.debian.org/pkg/openssl","statuses":[{"release_codename":"artful","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"disco","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1.0.1-4ubuntu5.31","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.0.1f-1ubuntu2.15","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.0.1f-1ubuntu9.8","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.0.1f-1ubuntu11.4","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"}]},{"name":"openssl098","source":"https://ubuntu.com/security/cve?package=openssl098","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl098","debian":"https://tracker.debian.org/pkg/openssl098","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":["USN-2639-1"],"notices":[{"id":"USN-2639-1","title":"OpenSSL vulnerabilities","summary":"Several security issues were fixed in OpenSSL.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n","references":[],"published":"2015-06-11T18:07:09.755916","description":"Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that\nOpenSSL incorrectly handled memory when buffering DTLS data. A remote\nattacker could use this issue to cause OpenSSL to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2014-8176)\n\nJoseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed\nECParameters structures. A remote attacker could use this issue to cause\nOpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)\n\nRobert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled\ncertain ASN1_TIME strings. A remote attacker could use this issue to cause\nOpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)\n\nMichal Zalewski discovered that OpenSSL incorrectly handled missing content\nwhen parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this\nissue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1790)\n\nEmilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket\nwhen being used by a multi-threaded client. A remote attacker could use\nthis issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1791)\n\nJohannes Bauer discovered that OpenSSL incorrectly handled verifying\nsignedData messages using the CMS code. A remote attacker could use this\nissue to cause OpenSSL to hang, resulting in a denial of service.\n(CVE-2015-1792)\n\nAs a security improvement, this update also modifies OpenSSL behaviour to\nreject DH key sizes below 768 bits, preventing a possible downgrade\nattack.\n","is_hidden":false,"release_packages":{"precise":[{"name":"openssl","version":"1.0.1-4ubuntu5.31","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1-4ubuntu5.31","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.31"}],"trusty":[{"name":"openssl","version":"1.0.1f-1ubuntu2.15","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libcrypto1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-dev","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-doc","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"openssl","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"}],"utopic":[{"name":"openssl","version":"1.0.1f-1ubuntu9.8","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu9.8","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu9.8"}],"vivid":[{"name":"openssl","version":"1.0.1f-1ubuntu11.4","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu11.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu11.4"}]},"type":"USN","cves_ids":["CVE-2014-8176","CVE-2015-1788","CVE-2015-1789","CVE-2015-1790","CVE-2015-1791","CVE-2015-1792"]}]},{"id":"CVE-2015-1790","published":"2015-06-11T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before\n0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b\nallows remote attackers to cause a denial of service (NULL pointer\ndereference and application crash) via a PKCS#7 blob that uses ASN.1\nencoding and lacks inner EncryptedContent data.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.openssl.org/news/secadv_20150611.txt","https://ubuntu.com/security/notices/USN-2639-1","https://www.cve.org/CVERecord?id=CVE-2015-1790"],"bugs":[""],"patches":{"openssl":[],"openssl098":[]},"tags":{},"packages":[{"name":"openssl","source":"https://ubuntu.com/security/cve?package=openssl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl","debian":"https://tracker.debian.org/pkg/openssl","statuses":[{"release_codename":"artful","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"disco","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1.0.1-4ubuntu5.31","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.0.1f-1ubuntu2.15","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.0.1f-1ubuntu9.8","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.0.1f-1ubuntu11.4","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"}]},{"name":"openssl098","source":"https://ubuntu.com/security/cve?package=openssl098","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl098","debian":"https://tracker.debian.org/pkg/openssl098","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":["USN-2639-1"],"notices":[{"id":"USN-2639-1","title":"OpenSSL vulnerabilities","summary":"Several security issues were fixed in OpenSSL.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n","references":[],"published":"2015-06-11T18:07:09.755916","description":"Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that\nOpenSSL incorrectly handled memory when buffering DTLS data. A remote\nattacker could use this issue to cause OpenSSL to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2014-8176)\n\nJoseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed\nECParameters structures. A remote attacker could use this issue to cause\nOpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)\n\nRobert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled\ncertain ASN1_TIME strings. A remote attacker could use this issue to cause\nOpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)\n\nMichal Zalewski discovered that OpenSSL incorrectly handled missing content\nwhen parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this\nissue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1790)\n\nEmilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket\nwhen being used by a multi-threaded client. A remote attacker could use\nthis issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1791)\n\nJohannes Bauer discovered that OpenSSL incorrectly handled verifying\nsignedData messages using the CMS code. A remote attacker could use this\nissue to cause OpenSSL to hang, resulting in a denial of service.\n(CVE-2015-1792)\n\nAs a security improvement, this update also modifies OpenSSL behaviour to\nreject DH key sizes below 768 bits, preventing a possible downgrade\nattack.\n","is_hidden":false,"release_packages":{"precise":[{"name":"openssl","version":"1.0.1-4ubuntu5.31","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1-4ubuntu5.31","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.31"}],"trusty":[{"name":"openssl","version":"1.0.1f-1ubuntu2.15","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libcrypto1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-dev","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-doc","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"openssl","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"}],"utopic":[{"name":"openssl","version":"1.0.1f-1ubuntu9.8","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu9.8","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu9.8"}],"vivid":[{"name":"openssl","version":"1.0.1f-1ubuntu11.4","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu11.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu11.4"}]},"type":"USN","cves_ids":["CVE-2014-8176","CVE-2015-1788","CVE-2015-1789","CVE-2015-1790","CVE-2015-1791","CVE-2015-1792"]}]},{"id":"CVE-2015-1789","published":"2015-06-11T00:00:00","updated_at":"2025-08-25T21:35:15.429872+00:00","description":"\nThe X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before\n0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b\nallows remote attackers to cause a denial of service (out-of-bounds read\nand application crash) via a crafted length field in ASN1_TIME data, as\ndemonstrated by an attack against a server that supports client\nauthentication with a custom verification callback.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.openssl.org/news/secadv_20150611.txt","https://ubuntu.com/security/notices/USN-2639-1","https://www.cve.org/CVERecord?id=CVE-2015-1789"],"bugs":[""],"patches":{"openssl":[],"openssl098":[]},"tags":{},"packages":[{"name":"openssl","source":"https://ubuntu.com/security/cve?package=openssl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl","debian":"https://tracker.debian.org/pkg/openssl","statuses":[{"release_codename":"artful","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"disco","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1.0.1-4ubuntu5.31","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.0.1f-1ubuntu2.15","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.0.1f-1ubuntu9.8","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.0.1f-1ubuntu11.4","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"}]},{"name":"openssl098","source":"https://ubuntu.com/security/cve?package=openssl098","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl098","debian":"https://tracker.debian.org/pkg/openssl098","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":["USN-2639-1"],"notices":[{"id":"USN-2639-1","title":"OpenSSL vulnerabilities","summary":"Several security issues were fixed in OpenSSL.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n","references":[],"published":"2015-06-11T18:07:09.755916","description":"Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that\nOpenSSL incorrectly handled memory when buffering DTLS data. A remote\nattacker could use this issue to cause OpenSSL to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2014-8176)\n\nJoseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed\nECParameters structures. A remote attacker could use this issue to cause\nOpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)\n\nRobert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled\ncertain ASN1_TIME strings. A remote attacker could use this issue to cause\nOpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)\n\nMichal Zalewski discovered that OpenSSL incorrectly handled missing content\nwhen parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this\nissue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1790)\n\nEmilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket\nwhen being used by a multi-threaded client. A remote attacker could use\nthis issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1791)\n\nJohannes Bauer discovered that OpenSSL incorrectly handled verifying\nsignedData messages using the CMS code. A remote attacker could use this\nissue to cause OpenSSL to hang, resulting in a denial of service.\n(CVE-2015-1792)\n\nAs a security improvement, this update also modifies OpenSSL behaviour to\nreject DH key sizes below 768 bits, preventing a possible downgrade\nattack.\n","is_hidden":false,"release_packages":{"precise":[{"name":"openssl","version":"1.0.1-4ubuntu5.31","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1-4ubuntu5.31","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.31"}],"trusty":[{"name":"openssl","version":"1.0.1f-1ubuntu2.15","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libcrypto1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-dev","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-doc","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"openssl","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"}],"utopic":[{"name":"openssl","version":"1.0.1f-1ubuntu9.8","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu9.8","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu9.8"}],"vivid":[{"name":"openssl","version":"1.0.1f-1ubuntu11.4","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu11.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu11.4"}]},"type":"USN","cves_ids":["CVE-2014-8176","CVE-2015-1788","CVE-2015-1789","CVE-2015-1790","CVE-2015-1791","CVE-2015-1792"]}]},{"id":"CVE-2015-1788","published":"2015-06-11T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before\n0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b\ndoes not properly handle ECParameters structures in which the curve is over\na malformed binary polynomial field, which allows remote attackers to cause\na denial of service (infinite loop) via a session that uses an Elliptic\nCurve algorithm, as demonstrated by an attack against a server that\nsupports client authentication.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.openssl.org/news/secadv_20150611.txt","https://ubuntu.com/security/notices/USN-2639-1","https://www.cve.org/CVERecord?id=CVE-2015-1788"],"bugs":[""],"patches":{"openssl":[],"openssl098":[]},"tags":{},"packages":[{"name":"openssl","source":"https://ubuntu.com/security/cve?package=openssl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl","debian":"https://tracker.debian.org/pkg/openssl","statuses":[{"release_codename":"artful","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"disco","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1.0.1-4ubuntu5.31","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.0.1f-1ubuntu2.15","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.0.1f-1ubuntu9.8","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.0.1f-1ubuntu11.4","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"released","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"}]},{"name":"openssl098","source":"https://ubuntu.com/security/cve?package=openssl098","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl098","debian":"https://tracker.debian.org/pkg/openssl098","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":["USN-2639-1"],"notices":[{"id":"USN-2639-1","title":"OpenSSL vulnerabilities","summary":"Several security issues were fixed in OpenSSL.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n","references":[],"published":"2015-06-11T18:07:09.755916","description":"Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that\nOpenSSL incorrectly handled memory when buffering DTLS data. A remote\nattacker could use this issue to cause OpenSSL to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2014-8176)\n\nJoseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed\nECParameters structures. A remote attacker could use this issue to cause\nOpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)\n\nRobert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled\ncertain ASN1_TIME strings. A remote attacker could use this issue to cause\nOpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)\n\nMichal Zalewski discovered that OpenSSL incorrectly handled missing content\nwhen parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this\nissue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1790)\n\nEmilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket\nwhen being used by a multi-threaded client. A remote attacker could use\nthis issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1791)\n\nJohannes Bauer discovered that OpenSSL incorrectly handled verifying\nsignedData messages using the CMS code. A remote attacker could use this\nissue to cause OpenSSL to hang, resulting in a denial of service.\n(CVE-2015-1792)\n\nAs a security improvement, this update also modifies OpenSSL behaviour to\nreject DH key sizes below 768 bits, preventing a possible downgrade\nattack.\n","is_hidden":false,"release_packages":{"precise":[{"name":"openssl","version":"1.0.1-4ubuntu5.31","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1-4ubuntu5.31","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.31"}],"trusty":[{"name":"openssl","version":"1.0.1f-1ubuntu2.15","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libcrypto1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-dev","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-doc","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"openssl","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"}],"utopic":[{"name":"openssl","version":"1.0.1f-1ubuntu9.8","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu9.8","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu9.8"}],"vivid":[{"name":"openssl","version":"1.0.1f-1ubuntu11.4","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu11.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu11.4"}]},"type":"USN","cves_ids":["CVE-2014-8176","CVE-2015-1788","CVE-2015-1789","CVE-2015-1790","CVE-2015-1791","CVE-2015-1792"]}]},{"id":"CVE-2014-8176","published":"2015-06-11T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za,\n1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without\nconsidering that application data can arrive between a ChangeCipherSpec\nmessage and a Finished message, which allows remote DTLS peers to cause a\ndenial of service (memory corruption and application crash) or possibly\nhave unspecified other impact via unexpected application data.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.openssl.org/news/secadv_20150611.txt","https://ubuntu.com/security/notices/USN-2639-1","https://www.cve.org/CVERecord?id=CVE-2014-8176"],"bugs":["https://rt.openssl.org/Ticket/Display.html?id=3286"],"patches":{"openssl":["upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=bcc31166"],"openssl098":[]},"tags":{},"packages":[{"name":"openssl","source":"https://ubuntu.com/security/cve?package=openssl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl","debian":"https://tracker.debian.org/pkg/openssl","statuses":[{"release_codename":"artful","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1.0.1-4ubuntu5.31","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.0.1f-1ubuntu2.15","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.0.1f-1ubuntu9.8","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.0.1f-1ubuntu11.4","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.0.2c-1ubuntu1","component":null,"pocket":"security"}]},{"name":"openssl098","source":"https://ubuntu.com/security/cve?package=openssl098","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssl098","debian":"https://tracker.debian.org/pkg/openssl098","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":["USN-2639-1"],"notices":[{"id":"USN-2639-1","title":"OpenSSL vulnerabilities","summary":"Several security issues were fixed in OpenSSL.\n","instructions":"After a standard system update you need to reboot your computer to make\nall the necessary changes.\n","references":[],"published":"2015-06-11T18:07:09.755916","description":"Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that\nOpenSSL incorrectly handled memory when buffering DTLS data. A remote\nattacker could use this issue to cause OpenSSL to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2014-8176)\n\nJoseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed\nECParameters structures. A remote attacker could use this issue to cause\nOpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)\n\nRobert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled\ncertain ASN1_TIME strings. A remote attacker could use this issue to cause\nOpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)\n\nMichal Zalewski discovered that OpenSSL incorrectly handled missing content\nwhen parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this\nissue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1790)\n\nEmilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket\nwhen being used by a multi-threaded client. A remote attacker could use\nthis issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2015-1791)\n\nJohannes Bauer discovered that OpenSSL incorrectly handled verifying\nsignedData messages using the CMS code. A remote attacker could use this\nissue to cause OpenSSL to hang, resulting in a denial of service.\n(CVE-2015-1792)\n\nAs a security improvement, this update also modifies OpenSSL behaviour to\nreject DH key sizes below 768 bits, preventing a possible downgrade\nattack.\n","is_hidden":false,"release_packages":{"precise":[{"name":"openssl","version":"1.0.1-4ubuntu5.31","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1-4ubuntu5.31","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.31"}],"trusty":[{"name":"openssl","version":"1.0.1f-1ubuntu2.15","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libcrypto1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-dev","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl-doc","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"libssl1.0.0-udeb","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"},{"name":"openssl","version":"1.0.1f-1ubuntu2.15","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.15","pocket":"security"}],"utopic":[{"name":"openssl","version":"1.0.1f-1ubuntu9.8","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu9.8","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu9.8"}],"vivid":[{"name":"openssl","version":"1.0.1f-1ubuntu11.4","description":"Secure Socket Layer (SSL) cryptographic library and tools","is_source":true},{"name":"libssl1.0.0","version":"1.0.1f-1ubuntu11.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openssl","version_link":"https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu11.4"}]},"type":"USN","cves_ids":["CVE-2014-8176","CVE-2015-1788","CVE-2015-1789","CVE-2015-1790","CVE-2015-1791","CVE-2015-1792"]}]},{"id":"CVE-2015-3935","published":"2015-06-10T14:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5\nand 3.6 allow remote attackers to inject arbitrary web script or HTML via\nthe Business Search (search_nom) field to (1) htdocs/societe/societe.php or\n(2) htdocs/societe/admin/societe.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://github.com/Dolibarr/dolibarr/issues/2857","https://github.com/GPCsolutions/dolibarr/commit/a7f6bbd316e9b96216e9b2c7a065c9251c9a8907","https://github.com/Dolibarr/dolibarr/pull/2866","https://www.cve.org/CVERecord?id=CVE-2015-3935"],"bugs":[""],"patches":{"dolibarr":[]},"tags":{},"packages":[{"name":"dolibarr","source":"https://ubuntu.com/security/cve?package=dolibarr","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=dolibarr","debian":"https://tracker.debian.org/pkg/dolibarr","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.5.7+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.5.7+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [3.3.4-3]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":63220,"limit":20,"total_results":79316}