Vulnerabilities > Canonical > Ubuntu Linux > Medium

DATE CVE VULNERABILITY TITLE RISK
2016-07-21 CVE-2016-3521 Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: Types.
network
low complexity
ibm mariadb oracle debian canonical
6.5
2016-07-21 CVE-2016-3501 Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.
network
low complexity
oracle canonical
6.5
2016-07-21 CVE-2016-3486 Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: FTS.
network
low complexity
oracle canonical
6.5
2016-06-20 CVE-2016-2178 Information Exposure Through Discrepancy vulnerability in multiple products
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
5.5
2016-06-16 CVE-2016-2841 Improper Input Validation vulnerability in multiple products
The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.
local
low complexity
qemu canonical CWE-20
6.0
2016-06-16 CVE-2016-2392 The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
local
low complexity
qemu canonical
6.5
2016-06-16 CVE-2016-2391 NULL Pointer Dereference vulnerability in multiple products
The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
local
low complexity
qemu canonical debian CWE-476
5.0
2016-06-16 CVE-2012-6702 Cryptographic Issues vulnerability in multiple products
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
network
high complexity
libexpat-project google canonical debian CWE-310
5.9
2016-06-14 CVE-2016-5337 The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.
local
low complexity
qemu canonical debian
5.5
2016-06-14 CVE-2016-5238 Out-of-bounds Write vulnerability in multiple products
The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.
local
low complexity
qemu canonical debian CWE-787
4.4