Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

2,451 results · Clear filters · Feed

  • High max 8.8
    USN-5988-1 2 CVEs

    xcftools vulnerabilities

    It was discovered that integer overflows vulnerabilities existed in Xcftools. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-5086, CVE-2019-5087)

    first Mar 29, 2023
  • High max 8.7
    USN-5983-1 1 CVE

    php-nette vulnerability

    Cyku Hong discovered that Nette was not properly handling and validating data used for code generation. A remote attacker could possibly use this issue to execute arbitrary code.

    first Mar 29, 2023
  • High max 7.5
    USN-5958-1 4 CVEs

    ffmpeg vulnerabilities

    It was discovered that FFmpeg could be made to dereference a null pointer. An attacker could possibly use this to cause a denial of service via application crash. These issues only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04…

    first Mar 16, 2023
  • High max 8.8
    USN-5957-1 7 CVEs

    librecad vulnerabilities

    Cody Sixteen discovered that LibreCAD incorrectly handled memory when parsing DXF files. An attacker could use this issue to cause LibreCAD to crash, leading to a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-191…

    first Mar 15, 2023
  • High max 7.8
    USN-5955-1 1 CVE

    emacs24 vulnerability

    It was discovered that Emacs did not properly manage certain files when using htmlfontify functionality. A local attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary commands.

    first Mar 15, 2023
  • High max 7.5
    USN-5948-1 2 CVEs

    python-werkzeug vulnerabilities

    It was discovered that Werkzeug did not properly handle the parsing of nameless cookies. A remote attacker could possibly use this issue to shadow other cookies. (CVE-2023-23934) It was discovered that Werkzeug could be made to process unlimited number of mul…

    first Mar 13, 2023
  • High max 7.8
    USN-5937-1 1 CVE

    opusfile vulnerability

    It was discovered that Opusfile was not properly validating pointer arguments in some of its functions, which could lead to a NULL pointer dereference. An attacker could possibly use this issue to cause a denial of service or have other unspecified impacts.

    first Mar 8, 2023
  • High max 8.8
    USN-5947-1 3 CVEs

    php-twig, twig vulnerabilities

    Fabien Potencier discovered that Twig was not properly enforcing sandbox policies when dealing with objects automatically cast to strings by PHP. An attacker could possibly use this issue to expose sensitive information. This issue was only fixed in Ubuntu 16…

    first Mar 13, 2023
  • High max 7.5
    USN-5886-1 4 CVEs

    intel-microcode vulnerabilities

    Erik C. Bjorge discovered that some Intel(R) Atom and Intel Xeon Scalable Processors did not properly implement access controls for out-of-band management. This may allow a privileged network-adjacent user to potentially escalate privileges. (CVE-2022-21216) …

    first Feb 27, 2023
  • High max 7.8
    USN-7330-1 8 CVEs

    ansible vulnerabilities

    It was discovered that Ansible did not properly verify certain fields of X.509 certificates. An attacker could possibly use this issue to spoof SSL servers if they were able to intercept network communications. This issue only affected Ubuntu 14.04 LTS. (CVE-…

    first Mar 5, 2025
  • High max 8.1
    USN-7302-1 5 CVEs

    libxml2 vulnerabilities

    It was discovered that libxml2 incorrectly handled certain memory operations. A remote attacker could use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ub…

    first Feb 25, 2025
  • High max 7.0
    USN-7321-1 3 CVEs

    redis vulnerabilities

    It was discovered that Redis incorrectly handled certain memory operations during pattern matching. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-31228) It was discovered that Redis incorrectly handled certain specially cra…

    first Mar 5, 2025
  • High max 8.3
    USN-5866-1 5 CVEs

    nova vulnerabilities

    It was discovered that Nova did not properly manage data logged into the log file. An attacker with read access to the service's logs could exploit this issue and may obtain sensitive information. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS…

    first Feb 13, 2023
  • High max 7.8
    USN-5842-1 1 CVE

    editorconfig-core vulnerability

    Mark Esler and David Fernandez Gonzalez discovered that EditorConfig Core C incorrectly handled memory when handling certain inputs. An attacker could possibly use this issue to cause applications using EditorConfig Core C to crash, resulting in a denial of s…

    first Feb 6, 2023
  • High max 7.5
    USN-5837-2 1 CVE

    python-django vulnerability

    USN-5837-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Nick Pope discovered that Django incorrectly handled certain Accept-Language headers. A remote attacker could possibly u…

    first Feb 1, 2023
  • High max 7.5
    USN-5833-1 1 CVE

    python-future vulnerability

    Sebastian Chnelik discovered that python-future incorrectly handled certain HTTP header field. An attacker could possibly use this issue to cause a denial of service.

    first Jan 31, 2023
  • High max 7.5
    USN-5821-2 1 CVE

    wheel vulnerability

    USN-5821-1 fixed a vulnerability in wheel. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Sebastian Chnelik discovered that wheel incorrectly handled certain file names when validated against a regex expression.…

    first Jan 24, 2023
  • High max 7.8
    USN-5820-1 1 CVE

    exuberant-ctags vulnerability

    Lorenz Hipp discovered a flaw in exuberant-ctags handling of the tag filename command-line argument. A crafted tag filename specified in the command line or in the configuration file could result in arbitrary command execution.

    first Jan 24, 2023
  • High max 7.8
    USN-5811-2 1 CVE

    sudo vulnerability

    USN-5811-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly handled user-specified editors when using the sudoed…

    first Jan 18, 2023
  • High max 8.8
    USN-5807-2 3 CVEs

    libxpm vulnerabilities

    USN-5807-1 fixed vulnerabilities in libXpm. This update provides the corresponding updates for Ubuntu 16.04 ESM. Original advisory details: Martin Ettl discovered that libXpm incorrectly handled certain XPM files. If a user or automated system were tricked in…

    first Feb 21, 2023
  • High max 8.8
    USN-5806-1 1 CVE

    ruby2.3 vulnerability

    Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable …

    first Jan 17, 2023
  • High max 7.5
    USN-5785-1 3 CVEs

    freeradius vulnerabilities

    It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd handshakes. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17185) Shane Guan discovered that FreeRADIUS incorr…

    first Jan 4, 2023
  • High max 7.8
    USN-5781-1 1 CVE

    emacs24 vulnerability

    It was discovered that Emacs did not properly manage certain inputs. An attacker could possibly use this issue to execute arbitrary commands.

    first Dec 14, 2022
  • High max 7.8
    USN-5775-1 6 CVEs

    vim vulnerabilities

    It was discovered that Vim uses freed memory in recurisve substitution of specially crafted patterns. An attacker could possbly use this to crash Vim and cause denial of service. (CVE-2022-2345) It was discovered that Vim makes illegal memory calls when patte…

    first Dec 12, 2022
  • High max 8.8
    USN-5769-1 2 CVEs

    protobuf vulnerabilities

    It was discovered that protobuf did not properly manage memory when serializing large messages. An attacker could possibly use this issue to cause applications using protobuf to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE…

    first Dec 8, 2022
  • High max 7.8
    USN-5753-1 1 CVE

    snapd vulnerability

    The Qualys Research Team discovered that a race condition existed in the snapd snap-confine binary when preparing the private /tmp mount for a snap. A local attacker could possibly use this issue to escalate privileges and execute arbitrary code.

    first Dec 1, 2022
  • High max 8.8
    USN-6570-1 2 CVEs

    postgresql-9.5 vulnerabilities

    Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying certain SQL array values. A remote attacker could use this issue to obtain sensitive information, or possibly execute arbitrary code. (CVE-2023-5869) Hemanth Sandrana and Mahendrakar Srin…

    first Jan 9, 2024
  • High max 8.8
    USN-6485-1 1 CVE

    intel-microcode vulnerability

    Benoit Morgan, Paul Grosen, Thais Moreira Hamasaki, Ke Sun, Alyssa Milburn, Hisham Shafi, Nir Shlomovich, Tavis Ormandy, Daniel Moghimi, Josh Eads, Salman Qazi, Alexandra Sandulescu, Andy Nguyen, Eduardo Vela, Doug Kwan, and Kostik Shtoyk discovered that some…

    first Nov 17, 2023
  • High max 7.0
    USN-5735-1 1 CVE

    sysstat vulnerability

    It was discovered that Sysstat did not properly check bounds when perfoming certain arithmetic operations on 32 bit systems. An attacker could possibly use this issue to cause a crash or arbitrary code execution.

    first Nov 22, 2022
  • High max 7.8
    USN-5723-1 9 CVEs

    vim vulnerabilities

    It was discovered that Vim could be made to crash when searching specially crafted patterns. An attacker could possibly use this to crash Vim and cause denial of service. (CVE-2022-1674) It was discovered that there existed a NULL pointer dereference in Vim. …

    first Nov 14, 2022
  • High max 7.5
    USN-5712-1 1 CVE

    sqlite3 vulnerability

    It was discovered that SQLite did not properly handle large string inputs in certain circumstances. An attacker could possibly use this issue to cause a denial of service or arbitrary code execution.

    first Nov 3, 2022
  • High max 7.7
    USN-5705-1 2 CVEs

    tiff vulnerabilities

    Chintan Shah discovered that LibTIFF incorrectly handled memory in certain conditions. An attacker could trick a user into processing a specially crafted image file and potentially use this issue to allow for information disclosure or to cause the application…

    first Oct 27, 2022
  • High max 8.5
    USN-5686-2 1 CVE

    git vulnerability

    USN-5686-1 fixed several vulnerabilities in Git. This update provides the corresponding fix for CVE-2022-39260 on Ubuntu 16.04 ESM. Original advisory details: Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attacker could p…

    first Nov 17, 2022
  • High max 7.8
    USN-6555-2 2 CVEs

    xorg-server vulnerabilities

    USN-6555-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled XKB button actions. A…

    first Dec 13, 2023
  • High max 8.6
    USN-6500-2 2 CVEs

    squid3 vulnerabilities

    USN-6500-1 fixed several vulnerabilities in Squid. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Joshua Rogers discovered that Squid incorrectly handled the Gopher protocol. A remote attack…

    first Dec 11, 2023
  • High max 7.4
    USN-6463-2 2 CVEs

    open-vm-tools vulnerabilities

    USN-6463-1 fixed vulnerabilities in Open VM Tools. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that Open VM Tools incorrectly handled SAML tokens. A remote attacker wit…

    first Dec 6, 2023
  • High max 7.5
    USN-5638-3 1 CVE

    expat vulnerability

    USN-5638-1 fixed a vulnerability in Expat. This update provides the corresponding updates for Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-43680) This update also fixes a minor regression introduced in Ubu…

    first Nov 23, 2022
  • High max 8.1
    USN-5638-1 1 CVE

    expat vulnerability

    Rhodri James discovered that Expat incorrectly handled memory when processing certain malformed XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

    first Sep 26, 2022
  • High max 7.5
    USN-5625-1 1 CVE

    mako vulnerability

    It was discovered that Mako incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service.

    first Sep 21, 2022
  • High max 7.1
    USN-5618-1 1 CVE

    ghostscript vulnerability

    It was discovered the Ghostscript incorrectly handled memory when processing certain inputs. By tricking a user into opening a specially crafted PDF file, an attacker could cause the program to crash.

    first Sep 20, 2022