Vulnerabilities > Canonical > Ubuntu Linux > 14.04
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-05-21 | CVE-2015-4000 | Cryptographic Issues vulnerability in multiple products The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. | 3.7 |
| 2015-05-19 | CVE-2015-3409 | Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module. | 7.2 |
| 2015-05-19 | CVE-2015-3408 | Command Injection vulnerability in multiple products Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest. | 10.0 |
| 2015-05-19 | CVE-2015-3407 | Improper Access Control vulnerability in multiple products Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files. | 5.0 |
| 2015-05-12 | CVE-2015-3451 | XXE vulnerability in multiple products The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function. | 5.0 |
| 2015-05-12 | CVE-2015-2668 | Resource Management Errors vulnerability in multiple products ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file. | 5.0 |
| 2015-05-12 | CVE-2015-2222 | Resource Management Errors vulnerability in multiple products ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file. | 5.0 |
| 2015-05-12 | CVE-2015-2221 | Resource Management Errors vulnerability in multiple products ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file. | 5.0 |
| 2015-05-12 | CVE-2015-2170 | Resource Management Errors vulnerability in multiple products The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file. | 5.0 |
| 2015-05-01 | CVE-2015-3153 | Information Exposure vulnerability in multiple products The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents. | 5.0 |