Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

1,181 results · Clear filters · Feed

  • Medium max 6.3
    USN-6907-1 1 CVE

    squid, squid3 vulnerability

    Joshua Rogers discovered that Squid did not properly handle multi-byte characters during Edge Side Includes (ESI) processing. A remote attacker could possibly use this issue to cause a memory corruption error, leading to a denial of service.

    first Jul 23, 2024
  • Medium max 4.7
    USN-6904-1 1 CVE

    pymongo vulnerability

    It was discovered that PyMongo incorrectly handled certain BSON. An attacker could possibly use this issue to read sensitive information or cause a crash.

    first Jul 22, 2024
  • Medium max 6.5
    USN-6856-1 2 CVEs

    fontforge vulnerabilities

    It was discovered that FontForge incorrectly handled filenames. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a command injection. (CVE-2024-25081) It was …

    first Jun 27, 2024
  • Medium max 6.1
    USN-6848-1 4 CVEs 2 exploited

    roundcube vulnerabilities

    Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly handled certain SVG images. A remote attacker could possibly use this issue to load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS…

    first Jun 25, 2024
  • Medium max 4.4
    USN-6844-1 1 CVE

    cups vulnerability

    Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd process fails to validate if bind call passed. An attacker could possibly trick cupsd to perform an arbitrary chmod of the provided argument, providing wo…

    first Jun 24, 2024
  • Medium max 6.5
    USN-6842-1 5 CVEs

    gdb vulnerabilities

    It was discovered that gdb incorrectly handled certain memory operations when parsing an ELF file. An attacker could possibly use this issue to cause a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. This issue only affect…

    first Jun 20, 2024
  • Medium max 6.2
    USN-6780-1 1 CVE

    python-idna vulnerability

    Guido Vranken discovered that idna did not properly manage certain inputs, which could lead to significant resource consumption. An attacker could possibly use this issue to cause a denial of service.

    first May 21, 2024
  • Medium max 5.3
    USN-6761-1 1 CVE

    anope vulnerability

    It was discovered that Anope did not properly process credentials for suspended accounts. An attacker could possibly use this issue to normally login to the platform as a suspended user after changing their password.

    first Apr 30, 2024
  • Medium max 6.5
    USN-6757-1 3 CVEs

    php7.0, php7.2, php7.4, php8.1 vulnerabilities

    It was discovered that PHP incorrectly handled PHP_CLI_SERVER_WORKERS variable. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-4900) It was disco…

    first Apr 29, 2024
  • Medium max 5.9
    USN-6738-1 1 CVE

    lxd vulnerability

    Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD incorrectly handled the handshake phase and the use of sequence numbers in SSH Binary Packet Protocol (BPP). If a user or an automated system were tricked into opening a specially crafted i…

    first Apr 22, 2024
  • Medium max 4.4
    USN-6676-1 1 CVE

    c-ares vulnerability

    Vojtěch Vobr discovered that c-ares incorrectly handled user input from local configuration files. An attacker could possibly use this issue to cause a denial of service via application crash.

    first Mar 6, 2024
  • Medium max 6.1
    USN-6654-1 1 CVE 1 exploited

    roundcube vulnerability

    It was discovered that Roundcube Webmail incorrectly sanitized characters in the linkrefs text messages. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2023-43770)

    first Feb 26, 2024
  • Medium max 6.5
    USN-6641-1 1 CVE

    curl vulnerability

    Harry Sintonen discovered that curl incorrectly handled mixed case cookie domains. A remote attacker could possibly use this issue to set cookies that get sent to different and unrelated sites and domains.

    first Feb 19, 2024
  • Medium max 5.5
    USN-6632-1 2 CVEs

    openssl vulnerabilities

    David Benjamin discovered that OpenSSL incorrectly handled excessively long X9.42 DH keys. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, leading to a denial of service. (CVE-2023-5678) Bahaa Naamneh discovered that Ope…

    first Feb 13, 2024
  • Medium max 5.0
    USN-7423-2 3 CVEs

    binutils vulnerabilities

    USN-7423-1 fixed several vulnerabilities in GNU. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could poss…

    first Apr 29, 2025
  • Medium max 4.8
    USN-6592-2 2 CVEs

    libssh vulnerabilities

    USN-6592-1 fixed vulnerabilities in libssh. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that libssh incorrectly handled the ProxyCommand and the ProxyJump features. A r…

    first Feb 5, 2024
  • Medium max 6.5
    USN-6560-3 1 CVE

    openssh vulnerability

    USN-6560-2 fixed a vulnerability in OpenSSH. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: It was discovered that OpenSSH incorrectly handled user names or host names with shell metacharacters. An attacker coul…

    first Sep 16, 2024
  • Medium max 6.5
    USN-6560-2 2 CVEs

    openssh vulnerabilities

    USN-6560-1 fixed several vulnerabilities in OpenSSH. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnera…

    first Jan 11, 2024
  • Medium max 4.3
    USN-6374-1 2 CVEs

    mutt vulnerabilities

    It was discovered that Mutt incorrectly handled certain email header contents. If a user were tricked into opening a specially crafted message, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-4874, CVE-2023-4875)

    first Sep 14, 2023
  • Medium max 6.5
    USN-6372-1 1 CVE

    dbus vulnerability

    It was discovered that DBus incorrectly handled certain invalid messages. A local attacker could possibly use this issue to cause DBus to crash, resulting in a denial of service.

    first Sep 14, 2023
  • Medium max 5.9
    USN-7360-1 3 CVEs

    alpine vulnerabilities

    It was discovered that Alpine did not use a secure connection under certain circumstances. A remote attacker could possibly use this issue to leak sensitive information. (CVE-2020-14929) It was discovered that Alpine could allow untagged responses from an IMA…

    first Mar 20, 2025
  • Medium max 6.3
    USN-7348-2 1 CVE

    python3.5, python3.8 regression

    USN-7348-1 fixed vulnerabilities in Python. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the Python ipaddress module contained incorrect information ab…

    first Mar 24, 2025
  • Medium max 5.5
    USN-6297-1 1 CVE

    ghostscript vulnerability

    It was discovered that Ghostscript incorrectly handled outputting certain PDF files. A local attacker could potentially use this issue to cause a crash, resulting in a denial of service.

    first Aug 17, 2023
  • Medium max 5.9
    USN-6288-2 3 CVEs

    mysql-5.7 vulnerability

    USN-6288-1 fixed a vulnerability in MySQL. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versio…

    first Oct 24, 2023
  • Medium max 6.1
    USN-6282-1 1 CVE

    velocity-tools vulnerability

    Jackson Henry discovered that Velocity Tools incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code.

    first Aug 10, 2023
  • Medium max 6.2
    USN-6280-1 1 CVE

    pypdf2 vulnerability

    It was discovered that PyPDF2 incorrectly handled PDF files with certain markers. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to consume system resources, resulting in a denial…

    first Aug 10, 2023
  • Medium max 5.3
    USN-6219-1 2 CVEs

    ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.1 vulnerabilities

    It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.10 and Ubuntu 20.04 LTS. (CVE-2023-28755) It was discovered that Ruby incor…

    first Jul 12, 2023
  • Medium max 4.2
    USN-6210-1 1 CVE

    ruby-doorkeeper vulnerability

    It was discovered that Doorkeeper incorrectly performed authorization checks for public clients that have been previous approved. An attacker could potentially exploit these in order to impersonate another user and obtain sensitive information.

    first Jul 7, 2023
  • Medium max 6.2
    USN-6202-1 2 CVEs

    containerd vulnerabilities

    David Korczynski and Adam Korczynski discovered that containerd incorrectly processed certain images with large files. An attacker could possibly use this issue to cause containerd to crash, resulting in a denial of service. (CVE-2023-25153) It was discovered…

    first Jul 5, 2023
  • Medium max 5.3
    USN-6184-2 1 CVE

    cups vulnerability

    USN-6184-1 fixed a vulnerability in CUPS. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that CUPS incorrectly handled certain memory operations. An attacker could possibl…

    first Jul 17, 2023
  • Medium max 5.9
    USN-6179-1 1 CVE

    libjettison-java vulnerability

    It was discovered that Jettison incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.

    first Jun 20, 2023
  • Medium max 6.2
    USN-6176-1 1 CVE

    pypdf2 vulnerability

    It was discovered that PyPDF2 incorrectly handled certain PDF files. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to consume system resources, resulting in a denial of service.

    first Jun 19, 2023
  • Medium max 6.1
    USN-6159-1 1 CVE

    python-tornado vulnerability

    It was discovered that Tornado incorrectly handled certain redirect. An remote attacker could possibly use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

    first Jun 13, 2023
  • Medium max 6.1
    USN-6155-2 1 CVE

    requests vulnerability

    USN-6155-1 fixed a vulnerability in Requests. This update provides the corresponding update for Ubuntu 16.04 ESM and 18.04 ESM. Original advisory details: Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly leaked Proxy-Authorization header…

    first Jun 15, 2023
  • Medium max 5.3
    USN-6078-2 1 CVE

    libwebp vulnerability

    USN-6078-1 fixed a vulnerability in libwebp. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: Irvan Kurniawan discovered that libwebp incorrectly handled certain memory operations. If a user or automated system we…

    first Jul 18, 2023
  • Medium max 5.3
    USN-6055-2 1 CVE

    ruby2.3, ruby2.5, ruby2.7 regression

    USN-6055-1 fixed a vulnerability in Ruby. Unfortunately it introduced a regression. This update reverts the patches applied to CVE-2023-28755 in order to fix the regression pending further investigation. We apologize for the inconvenience. Original advisory d…

    first May 5, 2023
  • Medium max 5.5
    USN-6042-1 1 CVE

    cloud-init vulnerability

    James Golovich discovered that sensitive data could be exposed in logs. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

    first Apr 26, 2023
  • Medium max 6.5
    USN-6037-1 1 CVE

    Apache Commons Net vulnerability

    ZeddYu Lu discovered that the FTP client from Apache Commons Net trusted the host from PASV responses by default. A remote attacker with a malicious FTP server could redirect the client to another server, which could possibly result in leaked information abou…

    first Apr 28, 2023
  • Medium max 5.4
    USN-7343-1 3 CVEs

    jinja2 vulnerabilities

    Rafal Krupinski discovered that Jinja2 did not properly restrict the execution of code in situations where templates are used maliciously. An attacker with control over a template's filename and content could potentially use this issue to enable the execution…

    first Mar 11, 2025
  • Medium max 6.1
    USN-5956-2 1 CVE

    libphp-phpmailer vulnerability

    USN-5956-1 fixed vulnerabilities in PHPMailer. It was discovered that the fix for CVE-2017-11503 was incomplete. This update fixes the problem. Original advisory details: Dawid Golunski discovered that PHPMailer was not properly escaping user input data used …

    first Mar 15, 2023