Threats Tagged 'ubuntu-14-04-lts'

(An Improper Limitation of a Pathname to a Restricted Directory ('Path ...)

(A Double Free vulnerability in open-iscsi allows anunauthenticatedMITM ...)

(An Incorrect Authorization vulnerability in open-iscsi allowsunprivili ...)

HTML::Entities versions before 3.84 for Perl contain a vulnerability in the _decode_entities function where freed heap memory is read. This occurs due to a cached pointer into a reallocated and freed string buffer, leading to potential disclosure of adjacent heap contents. The issue affects multiple specific versions of libhtml-parser-perl, primarily used in various Ubuntu LTS releases. The vulnerability allows reading sensitive memory but does not impact integrity or availability.

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-14266.

The mtr utility is affected by an out-of-bound read vulnerability in the ipinfo_lookup() function. This flaw can be triggered by an attacker who controls the TXT DNS response used for AS lookups, specifically by returning a DNS response larger than 512 bytes with a crafted compression pointer in the answer NAME field. The vulnerability causes a reliable crash due to improper boundary handling in the dn_expand() function. This issue affects mtr through version 0.96 and was fixed in a specific commit.

An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

A vulnerability in golang-1.10 on Unix systems allows improper symlink resolution when opening files with os.Root. Specifically, if the final path component is a symbolic link and the path ends with a slash, the code may follow the symlink outside the intended root directory. This can lead to unauthorized file access. Multiple Ubuntu golang package versions are affected. No patch information is provided.