{"cves":[{"id":"CVE-2015-1258","published":"2015-05-20T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nGoogle Chrome before 43.0.2357.65 relies on libvpx code that was not built\nwith an appropriate --size-limit value, which allows remote attackers to\ntrigger a negative value for a size field, and consequently cause a denial\nof service or possibly have unspecified other impact, via a crafted frame\nsize in VP9 video data.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"build parameter is specific for chrome build"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://codereview.chromium.org/1106303002","https://code.google.com/p/chromium/issues/detail?id=450939","http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","https://ubuntu.com/security/notices/USN-2610-1","https://www.cve.org/CVERecord?id=CVE-2015-1258"],"bugs":[""],"patches":{"chromium-browser":[],"oxide-qt":[],"libvpx":["upstream: https://github.com/webmproject/libvpx/commit/943e43273b0a7369d07714e7fd2e19fecfb11c7c"]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"43.0.2357.81-0ubuntu0.14.04.1.1089","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"43.0.2357.65","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"43.0.2357.81-0ubuntu0.14.10.1.1131","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"43.0.2357.81-0ubuntu0.15.04.1.1170","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"43.0.2357.81-0ubuntu1.1179","component":null,"pocket":"security"}]},{"name":"libvpx","source":"https://ubuntu.com/security/cve?package=libvpx","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libvpx","debian":"https://tracker.debian.org/pkg/libvpx","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"oxide-qt","source":"https://ubuntu.com/security/cve?package=oxide-qt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=oxide-qt","debian":"https://tracker.debian.org/pkg/oxide-qt","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.7.8-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.7.8","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.7.8-0ubuntu0.14.10.1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.7.8-0ubuntu0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.7.8-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-2610-1"],"notices":[{"id":"USN-2610-1","title":"Oxide vulnerabilities","summary":"Several security issues were fixed in Oxide.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2015-05-21T14:49:16.005442","description":"Several security issues were discovered in the DOM implementation in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit these to bypass Same Origin Policy\nrestrictions. (CVE-2015-1253, CVE-2015-1254)\n\nA use-after-free was discovered in the WebAudio implementation in\nChromium. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial of\nservice via renderer crash, or execute arbitrary code with the privileges\nof the sandboxed render process. (CVE-2015-1255)\n\nA use-after-free was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash, or execute arbitrary code with the privileges of the sandboxed\nrender process. (CVE-2015-1256)\n\nA security issue was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash. (CVE-2015-1257)\n\nAn issue was discovered with the build of libvpx. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash, or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2015-1258)\n\nMultiple use-after-free issues were discovered in the WebRTC\nimplementation in Chromium. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit these to\ncause a denial of service via renderer crash, or execute arbitrary code\nwith the privileges of the sandboxed render process. (CVE-2015-1260)\n\nAn uninitialized value bug was discovered in the font shaping code in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit this to cause a denial of service\nvia renderer crash. (CVE-2015-1262)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2015-1265)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2015-3910)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqt-qmlplugin","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtquick0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqmlscene","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-chromedriver","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"}],"utopic":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.10.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"}],"vivid":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.15.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"}]},"type":"USN","cves_ids":["CVE-2015-1253","CVE-2015-1254","CVE-2015-1255","CVE-2015-1256","CVE-2015-1257","CVE-2015-1258","CVE-2015-1260","CVE-2015-1262","CVE-2015-1265","CVE-2015-3910"]}]},{"id":"CVE-2015-1257","published":"2015-05-20T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nplatform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in\nBlink, as used in Google Chrome before 43.0.2357.65, does not properly\nhandle an insufficient number of values in an feColorMatrix filter, which\nallows remote attackers to cause a denial of service (container overflow)\nor possibly have unspecified other impact via a crafted document.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://src.chromium.org/viewvc/blink?view=rev&revision=193911","https://src.chromium.org/viewvc/blink?view=rev&revision=193571","https://code.google.com/p/chromium/issues/detail?id=468519","http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","https://ubuntu.com/security/notices/USN-2610-1","https://www.cve.org/CVERecord?id=CVE-2015-1257"],"bugs":[""],"patches":{"chromium-browser":[],"oxide-qt":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"43.0.2357.81-0ubuntu0.14.04.1.1089","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"43.0.2357.65","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"43.0.2357.81-0ubuntu0.14.10.1.1131","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"43.0.2357.81-0ubuntu0.15.04.1.1170","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"43.0.2357.81-0ubuntu1.1179","component":null,"pocket":"security"}]},{"name":"oxide-qt","source":"https://ubuntu.com/security/cve?package=oxide-qt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=oxide-qt","debian":"https://tracker.debian.org/pkg/oxide-qt","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.7.8-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.7.8","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.7.8-0ubuntu0.14.10.1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.7.8-0ubuntu0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.7.8-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-2610-1"],"notices":[{"id":"USN-2610-1","title":"Oxide vulnerabilities","summary":"Several security issues were fixed in Oxide.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2015-05-21T14:49:16.005442","description":"Several security issues were discovered in the DOM implementation in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit these to bypass Same Origin Policy\nrestrictions. (CVE-2015-1253, CVE-2015-1254)\n\nA use-after-free was discovered in the WebAudio implementation in\nChromium. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial of\nservice via renderer crash, or execute arbitrary code with the privileges\nof the sandboxed render process. (CVE-2015-1255)\n\nA use-after-free was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash, or execute arbitrary code with the privileges of the sandboxed\nrender process. (CVE-2015-1256)\n\nA security issue was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash. (CVE-2015-1257)\n\nAn issue was discovered with the build of libvpx. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash, or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2015-1258)\n\nMultiple use-after-free issues were discovered in the WebRTC\nimplementation in Chromium. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit these to\ncause a denial of service via renderer crash, or execute arbitrary code\nwith the privileges of the sandboxed render process. (CVE-2015-1260)\n\nAn uninitialized value bug was discovered in the font shaping code in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit this to cause a denial of service\nvia renderer crash. (CVE-2015-1262)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2015-1265)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2015-3910)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqt-qmlplugin","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtquick0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqmlscene","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-chromedriver","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"}],"utopic":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.10.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"}],"vivid":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.15.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"}]},"type":"USN","cves_ids":["CVE-2015-1253","CVE-2015-1254","CVE-2015-1255","CVE-2015-1256","CVE-2015-1257","CVE-2015-1258","CVE-2015-1260","CVE-2015-1262","CVE-2015-1265","CVE-2015-3910"]}]},{"id":"CVE-2015-1256","published":"2015-05-20T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nUse-after-free vulnerability in the SVG implementation in Blink, as used in\nGoogle Chrome before 43.0.2357.65, allows remote attackers to cause a\ndenial of service or possibly have unspecified other impact via a crafted\ndocument that leverages improper handling of a shadow tree for a use\nelement.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://src.chromium.org/viewvc/blink?revision=194421&view=revision","https://codereview.chromium.org/1098913004","https://code.google.com/p/chromium/issues/detail?id=478549","http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","https://ubuntu.com/security/notices/USN-2610-1","https://www.cve.org/CVERecord?id=CVE-2015-1256"],"bugs":[""],"patches":{"chromium-browser":[],"oxide-qt":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"43.0.2357.81-0ubuntu0.14.04.1.1089","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"43.0.2357.65","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"43.0.2357.81-0ubuntu0.14.10.1.1131","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"43.0.2357.81-0ubuntu0.15.04.1.1170","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"43.0.2357.81-0ubuntu1.1179","component":null,"pocket":"security"}]},{"name":"oxide-qt","source":"https://ubuntu.com/security/cve?package=oxide-qt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=oxide-qt","debian":"https://tracker.debian.org/pkg/oxide-qt","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.7.8-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.7.8","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.7.8-0ubuntu0.14.10.1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.7.8-0ubuntu0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.7.8-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-2610-1"],"notices":[{"id":"USN-2610-1","title":"Oxide vulnerabilities","summary":"Several security issues were fixed in Oxide.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2015-05-21T14:49:16.005442","description":"Several security issues were discovered in the DOM implementation in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit these to bypass Same Origin Policy\nrestrictions. (CVE-2015-1253, CVE-2015-1254)\n\nA use-after-free was discovered in the WebAudio implementation in\nChromium. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial of\nservice via renderer crash, or execute arbitrary code with the privileges\nof the sandboxed render process. (CVE-2015-1255)\n\nA use-after-free was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash, or execute arbitrary code with the privileges of the sandboxed\nrender process. (CVE-2015-1256)\n\nA security issue was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash. (CVE-2015-1257)\n\nAn issue was discovered with the build of libvpx. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash, or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2015-1258)\n\nMultiple use-after-free issues were discovered in the WebRTC\nimplementation in Chromium. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit these to\ncause a denial of service via renderer crash, or execute arbitrary code\nwith the privileges of the sandboxed render process. (CVE-2015-1260)\n\nAn uninitialized value bug was discovered in the font shaping code in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit this to cause a denial of service\nvia renderer crash. (CVE-2015-1262)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2015-1265)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2015-3910)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqt-qmlplugin","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtquick0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqmlscene","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-chromedriver","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"}],"utopic":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.10.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"}],"vivid":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.15.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"}]},"type":"USN","cves_ids":["CVE-2015-1253","CVE-2015-1254","CVE-2015-1255","CVE-2015-1256","CVE-2015-1257","CVE-2015-1258","CVE-2015-1260","CVE-2015-1262","CVE-2015-1265","CVE-2015-3910"]}]},{"id":"CVE-2015-1255","published":"2015-05-20T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nUse-after-free vulnerability in\ncontent/renderer/media/webaudio_capturer_source.cc in the WebAudio\nimplementation in Google Chrome before 43.0.2357.65 allows remote attackers\nto cause a denial of service (heap memory corruption) or possibly have\nunspecified other impact by leveraging improper handling of a stop action\nfor an audio track.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://codereview.chromium.org/1071063005","https://code.google.com/p/chromium/issues/detail?id=473253","http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","https://ubuntu.com/security/notices/USN-2610-1","https://www.cve.org/CVERecord?id=CVE-2015-1255"],"bugs":[""],"patches":{"chromium-browser":[],"oxide-qt":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"43.0.2357.81-0ubuntu0.14.04.1.1089","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"43.0.2357.65","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"43.0.2357.81-0ubuntu0.14.10.1.1131","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"43.0.2357.81-0ubuntu0.15.04.1.1170","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"43.0.2357.81-0ubuntu1.1179","component":null,"pocket":"security"}]},{"name":"oxide-qt","source":"https://ubuntu.com/security/cve?package=oxide-qt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=oxide-qt","debian":"https://tracker.debian.org/pkg/oxide-qt","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.7.8-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.7.8","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.7.8-0ubuntu0.14.10.1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.7.8-0ubuntu0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.7.8-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-2610-1"],"notices":[{"id":"USN-2610-1","title":"Oxide vulnerabilities","summary":"Several security issues were fixed in Oxide.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2015-05-21T14:49:16.005442","description":"Several security issues were discovered in the DOM implementation in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit these to bypass Same Origin Policy\nrestrictions. (CVE-2015-1253, CVE-2015-1254)\n\nA use-after-free was discovered in the WebAudio implementation in\nChromium. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial of\nservice via renderer crash, or execute arbitrary code with the privileges\nof the sandboxed render process. (CVE-2015-1255)\n\nA use-after-free was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash, or execute arbitrary code with the privileges of the sandboxed\nrender process. (CVE-2015-1256)\n\nA security issue was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash. (CVE-2015-1257)\n\nAn issue was discovered with the build of libvpx. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash, or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2015-1258)\n\nMultiple use-after-free issues were discovered in the WebRTC\nimplementation in Chromium. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit these to\ncause a denial of service via renderer crash, or execute arbitrary code\nwith the privileges of the sandboxed render process. (CVE-2015-1260)\n\nAn uninitialized value bug was discovered in the font shaping code in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit this to cause a denial of service\nvia renderer crash. (CVE-2015-1262)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2015-1265)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2015-3910)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqt-qmlplugin","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtquick0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqmlscene","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-chromedriver","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"}],"utopic":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.10.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"}],"vivid":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.15.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"}]},"type":"USN","cves_ids":["CVE-2015-1253","CVE-2015-1254","CVE-2015-1255","CVE-2015-1256","CVE-2015-1257","CVE-2015-1258","CVE-2015-1260","CVE-2015-1262","CVE-2015-1265","CVE-2015-3910"]}]},{"id":"CVE-2015-1254","published":"2015-05-20T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\ncore/dom/Document.cpp in Blink, as used in Google Chrome before\n43.0.2357.65, enables the inheritance of the designMode attribute, which\nallows remote attackers to bypass the Same Origin Policy by leveraging the\navailability of editing.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://src.chromium.org/viewvc/blink?revision=192658&view=revision","https://code.google.com/p/chromium/issues/detail?id=444927","http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","https://ubuntu.com/security/notices/USN-2610-1","https://www.cve.org/CVERecord?id=CVE-2015-1254"],"bugs":[""],"patches":{"chromium-browser":[],"oxide-qt":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"43.0.2357.81-0ubuntu0.14.04.1.1089","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"43.0.2357.65","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"43.0.2357.81-0ubuntu0.14.10.1.1131","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"43.0.2357.81-0ubuntu0.15.04.1.1170","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"43.0.2357.81-0ubuntu1.1179","component":null,"pocket":"security"}]},{"name":"oxide-qt","source":"https://ubuntu.com/security/cve?package=oxide-qt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=oxide-qt","debian":"https://tracker.debian.org/pkg/oxide-qt","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.7.8-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.7.8","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.7.8-0ubuntu0.14.10.1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.7.8-0ubuntu0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.7.8-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-2610-1"],"notices":[{"id":"USN-2610-1","title":"Oxide vulnerabilities","summary":"Several security issues were fixed in Oxide.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2015-05-21T14:49:16.005442","description":"Several security issues were discovered in the DOM implementation in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit these to bypass Same Origin Policy\nrestrictions. (CVE-2015-1253, CVE-2015-1254)\n\nA use-after-free was discovered in the WebAudio implementation in\nChromium. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial of\nservice via renderer crash, or execute arbitrary code with the privileges\nof the sandboxed render process. (CVE-2015-1255)\n\nA use-after-free was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash, or execute arbitrary code with the privileges of the sandboxed\nrender process. (CVE-2015-1256)\n\nA security issue was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash. (CVE-2015-1257)\n\nAn issue was discovered with the build of libvpx. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash, or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2015-1258)\n\nMultiple use-after-free issues were discovered in the WebRTC\nimplementation in Chromium. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit these to\ncause a denial of service via renderer crash, or execute arbitrary code\nwith the privileges of the sandboxed render process. (CVE-2015-1260)\n\nAn uninitialized value bug was discovered in the font shaping code in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit this to cause a denial of service\nvia renderer crash. (CVE-2015-1262)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2015-1265)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2015-3910)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqt-qmlplugin","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtquick0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqmlscene","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-chromedriver","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"}],"utopic":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.10.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"}],"vivid":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.15.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"}]},"type":"USN","cves_ids":["CVE-2015-1253","CVE-2015-1254","CVE-2015-1255","CVE-2015-1256","CVE-2015-1257","CVE-2015-1258","CVE-2015-1260","CVE-2015-1262","CVE-2015-1265","CVE-2015-3910"]}]},{"id":"CVE-2015-1253","published":"2015-05-20T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\ncore/html/parser/HTMLConstructionSite.cpp in the DOM implementation in\nBlink, as used in Google Chrome before 43.0.2357.65, allows remote\nattackers to bypass the Same Origin Policy via crafted JavaScript code that\nappends a child to a SCRIPT element, related to the insert and\nexecuteReparentTask functions.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://src.chromium.org/viewvc/blink?revision=191807&view=revision","https://code.google.com/p/chromium/issues/detail?id=464552","http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","https://ubuntu.com/security/notices/USN-2610-1","https://www.cve.org/CVERecord?id=CVE-2015-1253"],"bugs":[""],"patches":{"chromium-browser":[],"oxide-qt":[]},"tags":{},"packages":[{"name":"chromium-browser","source":"https://ubuntu.com/security/cve?package=chromium-browser","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=chromium-browser","debian":"https://tracker.debian.org/pkg/chromium-browser","statuses":[{"release_codename":"precise","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"43.0.2357.81-0ubuntu0.14.04.1.1089","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"43.0.2357.65","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"43.0.2357.81-0ubuntu0.14.10.1.1131","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"43.0.2357.81-0ubuntu0.15.04.1.1170","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"43.0.2357.81-0ubuntu1.1179","component":null,"pocket":"security"}]},{"name":"oxide-qt","source":"https://ubuntu.com/security/cve?package=oxide-qt","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=oxide-qt","debian":"https://tracker.debian.org/pkg/oxide-qt","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.7.8-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.7.8","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"1.7.8-0ubuntu0.14.10.1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.7.8-0ubuntu0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"1.7.8-0ubuntu1","component":null,"pocket":"security"}]}],"notices_ids":["USN-2610-1"],"notices":[{"id":"USN-2610-1","title":"Oxide vulnerabilities","summary":"Several security issues were fixed in Oxide.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2015-05-21T14:49:16.005442","description":"Several security issues were discovered in the DOM implementation in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit these to bypass Same Origin Policy\nrestrictions. (CVE-2015-1253, CVE-2015-1254)\n\nA use-after-free was discovered in the WebAudio implementation in\nChromium. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial of\nservice via renderer crash, or execute arbitrary code with the privileges\nof the sandboxed render process. (CVE-2015-1255)\n\nA use-after-free was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash, or execute arbitrary code with the privileges of the sandboxed\nrender process. (CVE-2015-1256)\n\nA security issue was discovered in the SVG implementation in Blink. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash. (CVE-2015-1257)\n\nAn issue was discovered with the build of libvpx. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash, or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2015-1258)\n\nMultiple use-after-free issues were discovered in the WebRTC\nimplementation in Chromium. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit these to\ncause a denial of service via renderer crash, or execute arbitrary code\nwith the privileges of the sandboxed render process. (CVE-2015-1260)\n\nAn uninitialized value bug was discovered in the font shaping code in\nBlink. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit this to cause a denial of service\nvia renderer crash. (CVE-2015-1262)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2015-1265)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2015-3910)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqt-qmlplugin","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"liboxideqtquick0","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqmlscene","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-chromedriver","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.04.1","pocket":"security"}],"utopic":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.14.10.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.14.10.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.14.10.1"}],"vivid":[{"name":"oxide-qt","version":"1.7.8-0ubuntu0.15.04.1","description":"Web browser engine library for Qt (QML plugin)","is_source":true},{"name":"liboxideqtcore0","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"},{"name":"oxideqt-codecs-extra","version":"1.7.8-0ubuntu0.15.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/oxide-qt","version_link":"https://launchpad.net/ubuntu/+source/oxide-qt/1.7.8-0ubuntu0.15.04.1"}]},"type":"USN","cves_ids":["CVE-2015-1253","CVE-2015-1254","CVE-2015-1255","CVE-2015-1256","CVE-2015-1257","CVE-2015-1258","CVE-2015-1260","CVE-2015-1262","CVE-2015-1265","CVE-2015-3910"]}]},{"id":"CVE-2015-3988","published":"2015-05-19T18:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard\n(Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web\nscript or HTML via the metadata to a (1) Glance image, (2) Nova flavor or\n(3) Host Aggregate.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"will not be fixed before 14.10 goes EoL"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/05/12/9","http://lists.openstack.org/pipermail/openstack-announce/2015-May/000358.html","https://www.cve.org/CVERecord?id=CVE-2015-3988"],"bugs":["https://launchpad.net/bugs/1449260"],"patches":{"horizon":["upstream: https://review.openstack.org/183659","upstream: https://review.openstack.org/183656","upstream: https://review.openstack.org/179429"]},"tags":{},"packages":[{"name":"horizon","source":"https://ubuntu.com/security/cve?package=horizon","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=horizon","debian":"https://tracker.debian.org/pkg/horizon","statuses":[{"release_codename":"precise","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2015.1.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"1:2015.1.1-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected [code not present]]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-0267","published":"2015-05-19T18:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe Red Hat module-setup.sh script for kexec-tools, as distributed in the\nkexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows\nlocal users to write to arbitrary files via a symlink attack on a temporary\nfile.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"vulnerable script not in debian/ubuntu"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://rhn.redhat.com/errata/RHSA-2015-0986.html","https://www.cve.org/CVERecord?id=CVE-2015-0267"],"bugs":[""],"patches":{"kexec-tools":[]},"tags":{},"packages":[{"name":"kexec-tools","source":"https://ubuntu.com/security/cve?package=kexec-tools","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kexec-tools","debian":"https://tracker.debian.org/pkg/kexec-tools","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty/esm was DNE [trusty was not-affected]","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3885","published":"2015-05-19T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nInteger overflow in the ljpeg_start function in dcraw 7.00 and earlier\nallows remote attackers to cause a denial of service (crash) via a crafted\nimage, which triggers a buffer overflow, related to the len variable.","ubuntu_description":"\nIt was discovered that FreeImage incorrectly handled photo files. If a user or\nautomated system were tricked into processing a specially crafted photo\nfile, a remote attacker could cause FreeImage to crash, resulting in a denial\nof service, or possibly execute arbitrary code.","notes":[],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.ocert.org/advisories/ocert-2015-006.html","https://codesearch.debian.net/results/int%20CLASS%20ljpeg_start","https://ubuntu.com/security/notices/USN-3492-1","https://www.cve.org/CVERecord?id=CVE-2015-3885"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=1221249","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=785019 (dcraw)","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767180 (kodi)","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786788 (libraw)"],"patches":{"libraw":["upstream: https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5"],"dcraw":[],"kodi":[],"freeimage":[],"darktable":[],"ufraw":[],"rawtherapee":[],"exactimage":[],"xbmc":[],"rawstudio":["upstream: https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e"]},"tags":{"libraw":["stack-protector"]},"packages":[{"name":"dcraw","source":"https://ubuntu.com/security/cve?package=dcraw","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=dcraw","debian":"https://tracker.debian.org/pkg/dcraw","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"9.27-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"kodi","source":"https://ubuntu.com/security/cve?package=kodi","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kodi","debian":"https://tracker.debian.org/pkg/kodi","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"16.0~rc3+dfsg2-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"2:20.5+dfsg-1build2","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"2:21.2+dfsg-1build2","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"2:21.2+dfsg-1build2","component":null,"pocket":"security"}]},{"name":"darktable","source":"https://ubuntu.com/security/cve?package=darktable","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=darktable","debian":"https://tracker.debian.org/pkg/darktable","statuses":[{"release_codename":"artful","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.2-1+deb8u1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"1.6.8-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"exactimage","source":"https://ubuntu.com/security/cve?package=exactimage","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=exactimage","debian":"https://tracker.debian.org/pkg/exactimage","statuses":[{"release_codename":"impish","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.9.1-6","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"freeimage","source":"https://ubuntu.com/security/cve?package=freeimage","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=freeimage","debian":"https://tracker.debian.org/pkg/freeimage","statuses":[{"release_codename":"impish","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"3.15.4-3ubuntu0.1+esm2","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"3.15.4-6","component":null,"pocket":"security"}]},{"name":"libraw","source":"https://ubuntu.com/security/cve?package=libraw","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libraw","debian":"https://tracker.debian.org/pkg/libraw","statuses":[{"release_codename":"impish","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.15.4-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.16.0-9+deb8u3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"0.17.1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"0.17.2-6","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"0.18.1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"0.18.2-1","component":null,"pocket":"security"}]},{"name":"rawstudio","source":"https://ubuntu.com/security/cve?package=rawstudio","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rawstudio","debian":"https://tracker.debian.org/pkg/rawstudio","statuses":[{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"rawtherapee","source":"https://ubuntu.com/security/cve?package=rawtherapee","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rawtherapee","debian":"https://tracker.debian.org/pkg/rawtherapee","statuses":[{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.2-2","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"4.2-4","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4.2-4build1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"ufraw","source":"https://ubuntu.com/security/cve?package=ufraw","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ufraw","debian":"https://tracker.debian.org/pkg/ufraw","statuses":[{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"0.20-3","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"0.20-3","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"0.20-3","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.20-3","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"0.20-3","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]},{"name":"xbmc","source":"https://ubuntu.com/security/cve?package=xbmc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xbmc","debian":"https://tracker.debian.org/pkg/xbmc","statuses":[{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"artful","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":["USN-3492-1"],"notices":[{"id":"USN-3492-1","title":"LibRaw vulnerabilities","summary":"LibRaw could be made to crash or run programs as your login if it opened a\nspecially crafted file.\n","instructions":"After a standard system update you need to restart your session to make\nall the necessary changes.\n","references":[],"published":"2017-11-22T18:27:06.090295","description":"It was discovered that LibRaw incorrectly handled photo files. If a user or\nautomated system were tricked into processing a specially crafted photo\nfile, a remote attacker could cause applications linked against LibRaw\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode\n","is_hidden":false,"release_packages":{"artful":[{"name":"libraw","version":"0.18.2-2ubuntu0.1","description":"raw image decoder library","is_source":true},{"name":"libraw16","version":"0.18.2-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.18.2-2ubuntu0.1"}],"trusty":[{"name":"libraw","version":"0.15.4-1ubuntu0.1","description":"raw image decoder library","is_source":true},{"name":"libraw-bin","version":"0.15.4-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.15.4-1ubuntu0.1","pocket":"security"},{"name":"libraw-dev","version":"0.15.4-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.15.4-1ubuntu0.1","pocket":"security"},{"name":"libraw-doc","version":"0.15.4-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.15.4-1ubuntu0.1","pocket":"security"},{"name":"libraw9","version":"0.15.4-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.15.4-1ubuntu0.1","pocket":"security"}],"xenial":[{"name":"libraw","version":"0.17.1-1ubuntu0.1","description":"raw image decoder library","is_source":true},{"name":"libraw-bin","version":"0.17.1-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.17.1-1ubuntu0.1","pocket":"security"},{"name":"libraw-dev","version":"0.17.1-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.17.1-1ubuntu0.1","pocket":"security"},{"name":"libraw-doc","version":"0.17.1-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.17.1-1ubuntu0.1","pocket":"security"},{"name":"libraw15","version":"0.17.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.17.1-1ubuntu0.1","pocket":"security"}],"zesty":[{"name":"libraw","version":"0.18.1-1ubuntu0.1","description":"raw image decoder library","is_source":true},{"name":"libraw16","version":"0.18.1-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libraw","version_link":"https://launchpad.net/ubuntu/+source/libraw/0.18.1-1ubuntu0.1"}]},"type":"USN","cves_ids":["CVE-2015-3885","CVE-2015-8366","CVE-2015-8367","CVE-2017-13735","CVE-2017-14265","CVE-2017-14348","CVE-2017-14608","CVE-2017-6886","CVE-2017-6887"]}]},{"id":"CVE-2015-3631","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nDocker Engine before 1.6.1 allows local users to set arbitrary Linux\nSecurity Modules (LSM) and docker_t policies via an image that allows\nvolumes to override files in /proc.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/05/07/10","https://www.cve.org/CVERecord?id=CVE-2015-3631"],"bugs":[""],"patches":{"docker.io":[]},"tags":{},"packages":[{"name":"docker.io","source":"https://ubuntu.com/security/cve?package=docker.io","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=docker.io","debian":"https://tracker.debian.org/pkg/docker.io","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.6.2~dfsg1-1ubuntu4~14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.6.2~dfsg1-1ubuntu4","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.10.3-0ubuntu6","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3630","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nDocker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2)\n/proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows\nlocal users to modify the host, obtain sensitive information, and perform\nprotocol downgrade attacks via a crafted image.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/05/07/10","https://www.cve.org/CVERecord?id=CVE-2015-3630"],"bugs":[""],"patches":{"docker.io":[]},"tags":{},"packages":[{"name":"docker.io","source":"https://ubuntu.com/security/cve?package=docker.io","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=docker.io","debian":"https://tracker.debian.org/pkg/docker.io","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.6.2~dfsg1-1ubuntu4~14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.6.2~dfsg1-1ubuntu4","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.10.3-0ubuntu6","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3629","published":"2015-05-18T15:59:00","updated_at":"2025-08-25T21:38:35.585099+00:00","description":"\nLibcontainer 1.6.0, as used in Docker Engine, allows local users to escape\ncontainerization (\"mount namespace breakout\") and write to arbitrary file\non the host system via a symlink attack in an image when respawning a\ncontainer.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/05/07/10","https://www.cve.org/CVERecord?id=CVE-2015-3629"],"bugs":[""],"patches":{"docker.io":[]},"tags":{},"packages":[{"name":"docker.io","source":"https://ubuntu.com/security/cve?package=docker.io","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=docker.io","debian":"https://tracker.debian.org/pkg/docker.io","statuses":[{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.6.2~dfsg1-1ubuntu4~14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.6.2~dfsg1-1ubuntu4","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.10.3-0ubuntu6","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3627","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nLibcontainer and Docker Engine before 1.6.1 opens the file-descriptor\npassed to the pid-1 process before performing the chroot, which allows\nlocal users to gain privileges via a symlink attack in an image.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/05/07/10","https://www.cve.org/CVERecord?id=CVE-2015-3627"],"bugs":[""],"patches":{"docker.io":[]},"tags":{},"packages":[{"name":"docker.io","source":"https://ubuntu.com/security/cve?package=docker.io","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=docker.io","debian":"https://tracker.debian.org/pkg/docker.io","statuses":[{"release_codename":"trusty","status":"released","description":"1.6.2~dfsg1-1ubuntu4~14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.6.2~dfsg1-1ubuntu4","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"1.10.3-0ubuntu6","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3455","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nSquid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and\n3.5.x before 3.5.4, when configured with client-first SSL-bump, do not\nproperly validate the domain or hostname fields of X.509 certificates,\nwhich allows man-in-the-middle attackers to spoof SSL servers via a valid\ncertificate.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"only an issue if squid3 is built with --enable-ssl, which isn't\nthe case on debian/ubuntu for licensing reasons.\nHowever, we should probably fix this anyway as rebuilding\nthe Ubuntu package locally to enable ssl is a common scenario.\n3.1.x not affected"}],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.squid-cache.org/Advisories/SQUID-2015_1.txt","http://www.openwall.com/lists/oss-security/2015/04/30/2","https://www.cve.org/CVERecord?id=CVE-2015-3455"],"bugs":[""],"patches":{"squid3":["upstream: http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12690.patch"]},"tags":{},"packages":[{"name":"squid3","source":"https://ubuntu.com/security/cve?package=squid3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=squid3","debian":"https://tracker.debian.org/pkg/squid3","statuses":[{"release_codename":"precise","status":"not-affected","description":"3.1.19-1ubuntu3.12.04.4","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"3.3.8-1ubuntu6.6","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.5.4,3.4.13,3.3.14,3.2.14","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"released","description":"3.3.8-1ubuntu16.2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3306","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and\nwrite to arbitrary files via the site cpfr and site cpto commands.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/04/15/2","https://cxsecurity.com/issue/WLB-2015040075","https://www.cve.org/CVERecord?id=CVE-2015-3306"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/proftpd-dfsg/+bug/1462311","http://bugs.proftpd.org/show_bug.cgi?id=4169"],"patches":{"proftpd-dfsg":["upstream: https://github.com/proftpd/proftpd/pull/109"]},"tags":{},"packages":[{"name":"proftpd-dfsg","source":"https://ubuntu.com/security/cve?package=proftpd-dfsg","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=proftpd-dfsg","debian":"https://tracker.debian.org/pkg/proftpd-dfsg","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"released","description":"1.3.4a-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.3.5~rc3-2.1ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"1.3.5-1.1+deb8u1build0.15.04.1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"1.3.5-2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"1.3.5-2","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"1.3.5-2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-2704","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nrealmd allows remote attackers to inject arbitrary configurations in to\nsssd.conf and smb.conf via a newline character in an LDAP response.","ubuntu_description":"\nIt was discovered that realmd incorrectly handled newline characters in\nLDAP responses. A remote attacker could possible use this to inject\narbitrary sssd.conf configuration.","notes":[{"author":"sbeattie","note":"no fix available upstream as 2015.03.26"},{"author":"msalvatore","note":"fix released 2015.04.14"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://bugs.freedesktop.org/show_bug.cgi?id=89207","https://www.cve.org/CVERecord?id=CVE-2015-2704"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781179","https://bugs.freedesktop.org/show_bug.cgi?id=89207"],"patches":{"realmd":[]},"tags":{},"packages":[{"name":"realmd","source":"https://ubuntu.com/security/cve?package=realmd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=realmd","debian":"https://tracker.debian.org/pkg/realmd","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"0.16.0-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.15.0-1ubuntu0.1+esm1","component":null,"pocket":"esm-infra"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-1868","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x\nbefore 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x,\n3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause\na denial of service (CPU consumption or crash) via a request with a name\nthat refers to itself.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"3.2+ pdns only, 3.5+ recursor only"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/","https://www.cve.org/CVERecord?id=CVE-2015-1868"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/pdns/+bug/1450037"],"patches":{"pdns":[],"pdns-recursor":[]},"tags":{},"packages":[{"name":"pdns","source":"https://ubuntu.com/security/cve?package=pdns","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=pdns","debian":"https://tracker.debian.org/pkg/pdns","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"3.0-1.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"3.3-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.4.4","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.4.5-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"3.4.5-1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"3.4.5-1","component":null,"pocket":"security"}]},{"name":"pdns-recursor","source":"https://ubuntu.com/security/cve?package=pdns-recursor","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=pdns-recursor","debian":"https://tracker.debian.org/pkg/pdns-recursor","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"3.3-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"3.5.3-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.6.3,3.7.2","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"3.7.3-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"3.7.3-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"3.7.3-1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"3.6.2-2+deb8u2build0.15.04.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-0278","published":"2015-05-18T15:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nlibuv before 0.10.34 does not properly drop group privileges, which allows\ncontext-dependent attackers to gain privileges via unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://github.com/libuv/libuv/pull/215","https://www.cve.org/CVERecord?id=CVE-2015-0278"],"bugs":[""],"patches":{"libuv":["upstream: https://github.com/libuv/libuv/commit/66ab38918c911bcff025562cf06237d7fedaba0c"]},"tags":{},"packages":[{"name":"libuv","source":"https://ubuntu.com/security/cve?package=libuv","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libuv","debian":"https://tracker.debian.org/pkg/libuv","statuses":[{"release_codename":"artful","status":"not-affected","description":"0.10.28-6ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"0.10.28-6ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"0.10.28-6ubuntu1","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"0.10.28-6ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"0.10.28-6ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"0.10.28-6ubuntu1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"0.10.28-6ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-3427","published":"2015-05-14T14:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nQuassel before 0.12.2 does not properly re-initialize the database session\nwhen the PostgreSQL database is restarted, which allows remote attackers to\nconduct SQL injection attacks via a \\ (backslash) in a message.  NOTE: this\nvulnerability exists because of an incomplete fix for CVE-2013-4422.","ubuntu_description":"","notes":[{"author":"tyhicks","note":"Requires Quassel IRC before 0.9.1 and QT 4.8.5 or newer"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://quassel-irc.org/node/120","https://www.cve.org/CVERecord?id=CVE-2015-3427"],"bugs":["https://launchpad.net/bugs/1448911"],"patches":{"quassel":["upstream: https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283"]},"tags":{},"packages":[{"name":"quassel","source":"https://ubuntu.com/security/cve?package=quassel","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=quassel","debian":"https://tracker.debian.org/pkg/quassel","statuses":[{"release_codename":"lucid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"QT 4.8.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.10.0-0ubuntu2.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"utopic","status":"released","description":"0.10.1-0ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"vivid","status":"released","description":"0.12.2-0ubuntu0.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-0971","published":"2015-05-14T14:59:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe DER parser in Suricata before 2.0.8 allows remote attackers to cause a\ndenial of service (crash) via vectors related to SSL/TLS certificates.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://suricata-ids.org/2015/05/06/suricata-2-0-8-available/","https://www.cve.org/CVERecord?id=CVE-2015-0971"],"bugs":[""],"patches":{"suricata":["upstream: https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7"]},"tags":{},"packages":[{"name":"suricata","source":"https://ubuntu.com/security/cve?package=suricata","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=suricata","debian":"https://tracker.debian.org/pkg/suricata","statuses":[{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"1.4.7-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.0.8","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"2.0.8-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2.0.8-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"2.0.8-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"2.0.8-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":63360,"limit":20,"total_results":79316}