Vulnerabilities (CVE)

Filtered by vendor Ubuntu Subscribe
Filtered by product Ubuntu Linux
Total 75 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2010-0834 2 Dell, Ubuntu 2 Latitude 2110 Netbook, Ubuntu Linux 2024-02-28 9.3 HIGH N/A
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.
CVE-2008-5103 2 Dcgrendel, Ubuntu 2 Vmbuilder, Ubuntu Linux 2024-02-28 7.2 HIGH N/A
The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions.
CVE-2008-2808 3 Mozilla, Redhat, Ubuntu 10 Firefox, Seamonkey, Thunderbird and 7 more 2024-02-28 4.3 MEDIUM N/A
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings, which allows remote attackers to conduct cross-site scripting (XSS) attacks or have unspecified other impact via a crafted filename.
CVE-2009-2939 3 Debian, Postfix, Ubuntu 3 Debian Linux, Postfix, Ubuntu Linux 2024-02-28 6.9 MEDIUM N/A
The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.
CVE-2008-5104 2 Dcgrendel, Ubuntu 2 Vmbuilder, Ubuntu Linux 2024-02-28 7.2 HIGH N/A
Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions.
CVE-2009-0578 1 Ubuntu 1 Ubuntu Linux 2024-02-28 6.2 MEDIUM N/A
GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
CVE-2009-0365 1 Ubuntu 1 Ubuntu Linux 2024-02-28 4.6 MEDIUM N/A
nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler.
CVE-2007-3920 3 Compiz, Gnome, Ubuntu 3 Compiz, Screensaver, Ubuntu Linux 2024-02-28 6.2 MEDIUM N/A
GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical access to take control of the session after entering an Alt-Tab sequence, a related issue to CVE-2007-3069.
CVE-2007-4601 1 Ubuntu 1 Ubuntu Linux 2024-02-28 5.0 MEDIUM N/A
A regression error in tcp-wrappers 7.6.dbs-10 and 7.6.dbs-11 might allow remote attackers to bypass intended access restrictions when a service uses libwrap but does not specify server connection information.
CVE-2007-5159 3 Ntfs-3g, Redhat, Ubuntu 3 Ntfs-3g, Fedora, Ubuntu Linux 2024-02-28 4.6 MEDIUM N/A
The ntfs-3g package before 1.913-2.fc7 in Fedora 7, and an ntfs-3g package in Ubuntu 7.10/Gutsy, assign incorrect permissions (setuid root) to mount.ntfs-3g, which allows local users with fuse group membership to read from and write to arbitrary block devices, possibly involving a file descriptor leak.
CVE-2006-5466 2 Rpm, Ubuntu 2 Package Manager, Ubuntu Linux 2024-02-28 5.4 MEDIUM N/A
Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code via crafted RPM packages.
CVE-2007-1352 8 Mandrakesoft, Openbsd, Redhat and 5 more 14 Mandrake Linux, Mandrake Linux Corporate Server, Mandrake Multi Network Firewall and 11 more 2024-02-28 3.8 LOW N/A
Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.
CVE-2007-4137 6 Conectiva, Gentoo, Mandrakesoft and 3 more 8 Linux, Linux, Mandrake Linux and 5 more 2024-02-28 7.5 HIGH N/A
Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service (crash) via a crafted Unicode string that triggers a heap-based buffer overflow. NOTE: Qt 4 has the same error in the QUtf8Codec::convertToUnicode function, but it is not exploitable.
CVE-2006-5877 2 Enigmail, Ubuntu 2 Enigmail, Ubuntu Linux 2024-02-28 7.8 HIGH N/A
The enigmail extension before 0.94.2 does not properly handle large, encrypted file e-mail attachments, which allows remote attackers to cause a denial of service (crash), as demonstrated with Mozilla Thunderbird.
CVE-2006-6235 6 Gnu, Gpg4win, Redhat and 3 more 9 Privacy Guard, Gpg4win, Enterprise Linux and 6 more 2024-02-28 10.0 HIGH N/A
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
CVE-2006-5648 1 Ubuntu 1 Ubuntu Linux 2024-02-28 4.6 MEDIUM N/A
Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.
CVE-2007-1463 2 Inkscape, Ubuntu 2 Inkscape, Ubuntu Linux 2024-02-28 6.8 MEDIUM N/A
Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs.
CVE-2006-5649 1 Ubuntu 1 Ubuntu Linux 2024-02-28 4.6 MEDIUM N/A
Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspecified vectors.
CVE-2007-5365 5 Debian, Openbsd, Redhat and 2 more 7 Debian Linux, Openbsd, Enterprise Linux and 4 more 2024-02-28 7.2 HIGH N/A
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
CVE-2007-2637 2 Moinmoin, Ubuntu 2 Moinmoin, Ubuntu Linux 2024-02-28 5.0 MEDIUM N/A
MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors.