Threats Tagged 'ubuntu-pro-14-04-lts'

Two vulnerabilities in the pyasn1 library can lead to denial of service by exhausting system resources when decoding malformed or maliciously crafted certificates. These issues arise from uncontrolled recursion during decoding attempts. The affected versions include specific Ubuntu package versions of pyasn1. No CVSS score is provided, and no known exploits are reported in the wild.

A denial of service vulnerability exists in Apache Tomcat due to incomplete cleanup of WebSocket connections. WebSocket clients could keep connections open, causing increased resource consumption. This affects multiple Apache Tomcat versions from 8.5.0 through 8.5.98, 9.0.0-M1 through 9.0.85, 10.1.0-M1 through 10.1.18, and 11.0.0-M1 through 11.0.0-M16. Users are advised to upgrade to fixed versions 8.5.99, 9.0.86, 10.1.19, or 11.0.0-M17 to address the issue.

LuaJIT versions through 2.1 and OpenRusty luajit2 before v2.1-20240314 contain a vulnerability involving unsinking of IR_FSTORE for NULL metatable, which can lead to a Denial of Service (DoS) condition. This issue affects multiple specific versions of LuaJIT as packaged in various Ubuntu releases. The vulnerability does not impact confidentiality or integrity but can cause application or system availability disruption.

LuaJIT through version 2.1 and OpenRusty luajit2 before v2.1-20240314 contain an out-of-bounds read vulnerability in the stack-overflow handler located in lj_state.c. This vulnerability can lead to a high impact on confidentiality and availability without requiring user interaction or privileges. Multiple specific versions of LuaJIT are affected, including several Ubuntu package versions. No known exploits are reported in the wild at this time.

In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccp_feat_change_recv If dccp_feat_push_confirm() fails after new value for SP feature was accepted without reconciliation ('entry == NULL' branch), memory allocated for that value with dccp_feat_clone_sp_val() is never freed. Here is the kmemleak stack for this: unreferenced object 0xffff88801d4ab488 (size 8): comm "syz-executor310", pid 1127, jiffies 4295085598 (age 41.666s) hex dump (first 8 bytes): 01 b4 4a 1d 80 88 ff ff ..J..... backtrace: [<00000000db7cabfe>] kmemdup+0x23/0x50 mm/util.c:128 [<0000000019b38405>] kmemdup include/linux/string.h:465 [inline] [<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:371 [inline] [<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:367 [inline] [<0000000019b38405>] dccp_feat_change_recv net/dccp/feat.c:1145 [inline] [<0000000019b38405>] dccp_feat_parse_options+0x1196/0x2180 net/dccp/feat.c:1416 [<00000000b1f6d94a>] dccp_parse_options+0xa2a/0x1260 net/dccp/options.c:125 [<0000000030d7b621>] dccp_rcv_state_process+0x197/0x13d0 net/dccp/input.c:650 [<000000001f74c72e>] dccp_v4_do_rcv+0xf9/0x1a0 net/dccp/ipv4.c:688 [<00000000a6c24128>] sk_backlog_rcv include/net/sock.h:1041 [inline] [<00000000a6c24128>] __release_sock+0x139/0x3b0 net/core/sock.c:2570 [<00000000cf1f3a53>] release_sock+0x54/0x1b0 net/core/sock.c:3111 [<000000008422fa23>] inet_wait_for_connect net/ipv4/af_inet.c:603 [inline] [<000000008422fa23>] __inet_stream_connect+0x5d0/0xf70 net/ipv4/af_inet.c:696 [<0000000015b6f64d>] inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:735 [<0000000010122488>] __sys_connect_file+0x15c/0x1a0 net/socket.c:1865 [<00000000b4b70023>] __sys_connect+0x165/0x1a0 net/socket.c:1882 [<00000000f4cb3815>] __do_sys_connect net/socket.c:1892 [inline] [<00000000f4cb3815>] __se_sys_connect net/socket.c:1889 [inline] [<00000000f4cb3815>] __x64_sys_connect+0x6e/0xb0 net/socket.c:1889 [<00000000e7b1e839>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 [<0000000055e91434>] entry_SYSCALL_64_after_hwframe+0x67/0xd1 Clean up the allocated memory in case of dccp_feat_push_confirm() failure and bail out with an error reset code. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

An improper handling of case sensitivity vulnerability exists in Apache Tomcat's CGI servlet, allowing bypass of security constraints applied to the pathInfo component of a URI. This affects multiple Apache Tomcat versions including 11.0.0-M1 through 11.0.6, 10.1.0-M1 through 10.1.40, 9.0.0-M1 through 9.0.104, and some older EOL versions such as 8.5.0 through 8.5.100. The issue is fixed in versions 11.0.7, 10.1.41, and 9.0.105. Users should upgrade to these fixed versions to address the vulnerability.

A resource allocation vulnerability exists in Apache Tomcat versions from 11.0.0-M1 through 11.0.7, 10.1.0-M1 through 10.1.41, and 9.0.0.M1 through 9.0.105, including some older EOL versions such as 8.5.0 through 8.5.100. This flaw allows allocation of resources without limits or throttling, potentially leading to denial of service. Fixed versions are 11.0.8, 10.1.42, and 9.0.106. The vulnerability affects multiple Ubuntu package versions as listed. No known exploits in the wild have been reported.

An Improper Resource Shutdown or Release vulnerability exists in Apache Tomcat, affecting versions from 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0-M1 through 9.0.107. This vulnerability is known as the 'made you reset' attack. Users are advised to upgrade to versions 11.0.10, 10.1.44, or 9.0.108 where the issue is fixed.

An Integer Overflow vulnerability in Apache Tomcat affects certain multipart upload configurations, potentially allowing denial of service (DoS) by bypassing size limits. This impacts multiple Apache Tomcat versions from 6.0.37-1 through 11.0.8, including some end-of-life versions. The issue is fixed in Apache Tomcat versions 11.0.9, 10.1.43, and 9.0.107. Users are advised to upgrade to these fixed versions to mitigate the risk.

An improper resource shutdown or release vulnerability exists in Apache Tomcat affecting multiple versions from 6.0.37-1 through 11.0.11. When an error occurs during multipart upload processing, temporary files are not immediately cleaned up, relying instead on garbage collection. This can cause disk space exhaustion leading to a denial of service (DoS). Fixed versions are 11.0.12 or later, 10.1.47 or later, and 9.0.110 or later.