Most recent entries from osv_ubuntu

Withdrawn: UBUNTU-CVE-2010-4001

Sat, 06 Nov 2010 00:00:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: gromacs, Ubuntu:Pro:18.04:LTS: gromacs, Ubuntu:20.04:LTS: gromacs, Ubuntu:22.04:LTS: gromacs, Ubuntu:24.04:LTS: gromacs

** DISPUTED ** GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always added to the beginning of LD_LIBRARY_PATH at a later point in the script.

Withdrawn: UBUNTU-CVE-2011-4898

Mon, 30 Jan 2012 17:55:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: wordpress, Ubuntu:Pro:18.04:LTS: wordpress, Ubuntu:20.04:LTS: wordpress, Ubuntu:22.04:LTS: wordpress, Ubuntu:24.04:LTS: wordpress

** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective.

Withdrawn: UBUNTU-CVE-2011-4899

Mon, 30 Jan 2012 17:55:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: wordpress, Ubuntu:Pro:18.04:LTS: wordpress, Ubuntu:20.04:LTS: wordpress, Ubuntu:22.04:LTS: wordpress, Ubuntu:24.04:LTS: wordpress

** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments.

Withdrawn: UBUNTU-CVE-2012-0782

Mon, 30 Jan 2012 17:55:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: wordpress, Ubuntu:Pro:18.04:LTS: wordpress, Ubuntu:20.04:LTS: wordpress, Ubuntu:22.04:LTS: wordpress, Ubuntu:24.04:LTS: wordpress

** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance.

Withdrawn: UBUNTU-CVE-2012-0937

Mon, 30 Jan 2012 17:55:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: wordpress, Ubuntu:Pro:18.04:LTS: wordpress, Ubuntu:20.04:LTS: wordpress, Ubuntu:22.04:LTS: wordpress, Ubuntu:24.04:LTS: wordpress

** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time.

Withdrawn: UBUNTU-CVE-2012-5855

Wed, 10 Jul 2013 19:55:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: vlc

The SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of service (crash) via a crafted file name that triggers an incorrect string-length calculation when the file is added to VLC. NOTE: it is not clear whether this issue crosses privilege boundaries or whether it can be exploited without user interaction.

UBUNTU-CVE-2014-3621

Thu, 02 Oct 2014 00:00:00 +0000

Affected: Ubuntu:14.04:LTS: keystone

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

UBUNTU-CVE-2015-1329

Tue, 04 Aug 2015 00:00:00 +0000

Affected: Ubuntu:14.04:LTS: oxide-qt

Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.

Withdrawn: UBUNTU-CVE-2016-7919

Fri, 28 Oct 2016 15:59:00 +0000

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: moodle, Ubuntu:Pro:18.04:LTS: moodle

** DISPUTED ** Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields."

UBUNTU-CVE-2014-3498

Thu, 08 Jun 2017 18:29:00 +0000

Affected: Ubuntu:Pro:14.04:LTS: ansible

The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.