Threats Tagged 'ubuntu-pro-20-04-lts'

Two vulnerabilities in the pyasn1 library can lead to denial of service by exhausting system resources when decoding malformed or maliciously crafted certificates. These issues arise from uncontrolled recursion during decoding attempts. The affected versions include specific Ubuntu package versions of pyasn1. No CVSS score is provided, and no known exploits are reported in the wild.

Multiple security vulnerabilities were discovered in the Linux kernel affecting numerous subsystems including architecture-specific components, drivers, networking, file systems, and virtualization. These flaws could potentially allow an attacker to compromise the system. The update addresses a wide range of kernel components to correct these issues. No specific exploit details or severity scores are provided.

A stack-buffer-overflow vulnerability exists in LuaJIT through version 2.1 and OpenRusty luajit2 before v2.1-20240626 in the lj_strfmt_wfnum function within lj_strfmt_num.c. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. Multiple specific package versions of LuaJIT are affected. No known exploits are reported in the wild at this time.

LuaJIT versions through 2.1 and OpenRusty luajit2 before v2.1-20240314 contain a vulnerability involving unsinking of IR_FSTORE for NULL metatable, which can lead to a Denial of Service (DoS) condition. This issue affects multiple specific versions of LuaJIT as packaged in various Ubuntu releases. The vulnerability does not impact confidentiality or integrity but can cause application or system availability disruption.

LuaJIT through version 2.1 and OpenRusty luajit2 before v2.1-20240314 contain an out-of-bounds read vulnerability in the stack-overflow handler located in lj_state.c. This vulnerability can lead to a high impact on confidentiality and availability without requiring user interaction or privileges. Multiple specific versions of LuaJIT are affected, including several Ubuntu package versions. No known exploits are reported in the wild at this time.

Apache Tomcat versions from 11.0.0-M1 through 11.0.0-M20, 10.1.0-M1 through 10.1.24, and 9.0.13 through 9.0.89, as well as certain end-of-life versions, contain a vulnerability that allows resource allocation without limits or throttling. This can be exploited via the TLS handshake process to cause an OutOfMemoryError, potentially leading to denial of service. Fixed versions include 11.0.0-M21, 10.1.25, and 9.0.90.

A vulnerability in Apache Tomcat allows authentication bypass if a custom Jakarta Authentication ServerAuthContext component throws an exception without setting an HTTP failure status. No known Jakarta Authentication components currently behave this way. The issue affects multiple Apache Tomcat versions including 8.5.0 through 8.5.100, 9.0.0-M1 through 9.0.95, 10.1.0-M1 through 10.1.30, and 11.0.0-M1 through 11.0.0-M26. Users should upgrade to fixed versions 11.0.0, 10.1.31, or 9.0.96 to address this vulnerability.

An uncontrolled resource consumption vulnerability exists in the examples web application provided with Apache Tomcat, which can lead to denial of service. This affects multiple Apache Tomcat versions including 8.5.0 through 8.5.100, 9.0.0.M1 through 9.9.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1. Users are advised to upgrade to fixed versions 11.0.2, 10.1.34, or 9.0.98 to remediate the issue.

An improper input validation vulnerability exists in the generic SSO login functionality of the Sympa product. This issue could potentially allow unexpected or malformed input to be processed, which may lead to security risks depending on the context of use. No specific affected versions or detailed impact scenarios are provided. There is no CVSS score or vendor advisory available at this time.

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat affecting multiple versions including 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1. The vulnerability relates to the default servlet write capability on case insensitive file systems and requires specific Java system property configurations to mitigate. Later Tomcat versions (9.0.99, 10.1.35, 11.0.3) include checks and default settings to address this issue. Users must configure the system property sun.io.useCanonCaches appropriately depending on their Java version to fully mitigate the vulnerability.