Most recent entries from osv_ubuntu

UBUNTU-CVE-2005-1080

Mon, 02 May 2005 04:00:00 +0000

Affected: Ubuntu:14.04:LTS: openjdk-6

Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in filenames in a .jar file.

Withdrawn: UBUNTU-CVE-2006-2692

Wed, 31 May 2006 10:06:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: amule

Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal.

UBUNTU-CVE-2007-0255

Tue, 16 Jan 2007 23:28:00 +0000

Affected: Ubuntu:16.04:LTS: xine-ui, Ubuntu:18.04:LTS: xine-ui, Ubuntu:20.04:LTS: xine-ui, Ubuntu:22.04:LTS: xine-ui, Ubuntu:24.04:LTS: xine-ui, Ubuntu:25.10: xine-ui, Ubuntu:26.04:LTS: xine-ui

XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017.

UBUNTU-CVE-2007-0667

Fri, 02 Feb 2007 21:28:00 +0000

Affected: Ubuntu:16.04:LTS: sql-ledger

The redirect function in Form.pm for (1) LedgerSMB before 1.1.5 and (2) SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872.

UBUNTU-CVE-2007-1329

Wed, 07 Mar 2007 21:19:00 +0000

Affected: Ubuntu:16.04:LTS: sql-ledger

Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows remote attackers to read and overwrite arbitrary files, and execute arbitrary code, via . (dot) characters adjacent to (1) users and (2) users/members strings, which are removed by blacklisting functions that filter these strings and collapse into .. (dot dot) sequences.

UBUNTU-CVE-2007-1923

Tue, 10 Apr 2007 23:19:00 +0000

Affected: Ubuntu:16.04:LTS: sql-ledger

(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.

UBUNTU-CVE-2007-4559

Tue, 28 Aug 2007 01:17:00 +0000

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:20.04:LTS: python3.8, Ubuntu:22.04:LTS: python2.7, Ubuntu:22.04:LTS: python3.10 and 1 more

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

UBUNTU-CVE-2007-5109

Wed, 26 Sep 2007 23:17:00 +0000

Affected: Ubuntu:16.04:LTS: flatnuke, Ubuntu:18.04:LTS: flatnuke, Ubuntu:20.04:LTS: flatnuke, Ubuntu:22.04:LTS: flatnuke, Ubuntu:24.04:LTS: flatnuke, Ubuntu:25.10: flatnuke, Ubuntu:26.04:LTS: flatnuke

Cross-site request forgery (CSRF) vulnerability in index.php in FlatNuke 2.6, and possibly 3, allows remote attackers to change the password and privilege level of arbitrary accounts via the user parameter and modified (1) regpass and (2) level parameters in a none_Login action, as demonstrated by using a Flash object to automatically make the request.

Withdrawn: UBUNTU-CVE-2008-2751

Wed, 18 Jun 2008 19:41:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: glassfish, Ubuntu:Pro:18.04:LTS: glassfish

Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:…

Withdrawn: UBUNTU-CVE-2008-3931

Thu, 04 Sep 2008 18:41:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:18.04:LTS: r-base

javareconf in R 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files.