FAIL › dossier
canonical
VENDORDossier not yet built — the RAG curator builds one for players with ≥2 failure events. The failure history and sentiment below are live.
FAILURE HISTORY · 20
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-06-26 | CVE-2026-12411 | high | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. |
| 2026-04-09 | CVE-2025-15480 | critical | CVE-2025-15480: In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user cr |
| 2026-03-12 | CVE-2026-28384 | critical | CVE-2026-28384: An improper sanitization of the compression_algorithm parameter in Canonical LXD |
| 2020-05-01 | CVE-2020-10683 | critical | CVE-2020-10683: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Enti |
| 2020-01-29 | CVE-2019-20445 | critical | CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to |
| 2020-01-29 | CVE-2019-20444 | critical | CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a |
| 2020-01-08 | CVE-2019-20367 | critical | CVE-2019-20367: nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison fo |
| 2019-07-18 | CVE-2019-13962 | critical | CVE-2019-13962: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player t |
| 2019-06-19 | CVE-2019-12900 | critical | CVE-2019-12900: BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write |
| 2019-06-07 | CVE-2019-10160 | critical | CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python since commit d53 |
| 2019-05-30 | CVE-2019-8457 | critical | CVE-2019-8457: SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound re |
| 2019-03-23 | CVE-2019-9948 | critical | CVE-2019-9948: urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes |
| 2019-03-08 | CVE-2019-9636 | critical | CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handl |
| 2019-02-26 | CVE-2019-9169 | critical | CVE-2019-9169: In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in pos |
| 2018-09-18 | CVE-2018-1000802 | critical | CVE-2018-1000802: Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Impro |
| 2018-05-16 | CVE-2018-8014 | critical | CVE-2018-8014: The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to |
| 2017-08-10 | CVE-2016-5018 | critical | CVE-2016-5018: In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0. |
| 2017-05-23 | CVE-2016-9841 | critical | CVE-2016-9841: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecif |
| 2017-04-06 | CVE-2016-8735 | critical | CVE-2016-8735: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7 |
| 2016-05-26 | CVE-2016-0718 | critical | CVE-2016-0718: Expat allows context-dependent attackers to cause a denial of service (crash) or |
SENTIMENT · TRUSTED SOURCES
synthesismixed-0.20
Vulnerability acknowledged with available mitigation guidance.
synthesissevere-fallout-0.60
Canonical's Netty vulnerability was widely recognized as a critical flaw in a foundational Java library, leading to significant fallout despite eventual patching.
synthesisneutral+0.00
No coverage found for Canonical in the provided sources; sources are unrelated to the event.
synthesissevere-fallout-0.60
Canonical's regression of a previously patched vulnerability (CVE-2019-9636) in Python's URL parsing, allowing credential theft via crafted URLs, was widely noted as a significant security failure, th
synthesisneutral+0.00
No security press or authoritative commentary found in the provided sources; only a technical NVD entry and a failed DuckDuckGo bridge query are present, yielding no sentiment toward Canonical.
synthesissevere-fallout-0.60
Canonical's urllib vulnerability allowed remote attackers to bypass file URI blacklists, exposing sensitive data like /etc/passwd, reflecting a significant security oversight in Python 2.x.
synthesisneutral+0.00
No public sentiment data available from provided sources.
synthesissevere-fallout-0.60
Canonical's glibc vulnerability was a critical heap-based buffer over-read in a foundational library, widely recognized as a severe security failure despite eventual patching.
synthesissevere-fallout-0.60
Canonical's Python 2.7 command injection flaw in shutil was a serious security oversight allowing arbitrary file injection and DoS, though fixed quickly; press coverage was minimal and technical, lack
Vulnerability acknowledged with available mitigation guidance.
"dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j."
Severe technical flaw in a widely used library, though Canonical's response was generally adequate.
"HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'"
No substantive coverage; only a technical error in fetching the page.
Irrelevant source; no coverage of Canonical or CVE-2019-13962.
Irrelevant source; no coverage of Canonical or CVE-2019-13962.
No usable content; the source is a technical error page with no commentary on Canonical's handling or the vulnerability's impact.
Canonical's regression of a previously patched vulnerability (CVE-2019-9636) in Python's URL parsing, allowing credential theft via crafted URLs, was widely noted as a significant security failure, th
"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL."
Neutral; DuckDuckGo bridge returned an error and provided no content about the vulnerability or Canonical.
Neutral; NVD entry states the vulnerability factually without commentary on Canonical's response or impact.
"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."
No substantive coverage; the source returned a connection error and provided no information on Canonical's handling or the vulnerability's impact.
NVD entry confirms the vulnerability allowed remote attackers to bypass protection mechanisms, indicating a serious flaw in Canonical's Python 2.x urllib implementation.
"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs"
Neutral; no sentiment expressed.
Neutral; no sentiment expressed.
Severe technical flaw in a core system library, treated as a critical vulnerability requiring immediate attention and patching.
"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."
No substantive coverage; technical error in data retrieval prevents sentiment assessment.
No usable coverage; only a technical error response from a local bridge.
Technical acknowledgment of a serious vulnerability with quick fix, but no public praise or severe condemnation due to lack of broader press coverage.
"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive."