Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

1,181 results · Clear filters · Feed

  • Medium max 6.5
    USN-5855-2 2 CVEs

    imagemagick vulnerabilities

    USN-5855-1 fixed a vulnerability in ImageMagick. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. Original advisory details: It was discovered that ImageMagick incorrectly handled certain PNG images. If a…

    first Mar 15, 2023
  • Medium max 4.4
    USN-5736-2 17 CVEs

    imagemagick vulnerabilities

    USN-5736-1 fixed vulnerabilities in ImageMagick. This update provides the corresponding updates for Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. One of the issues, CVE-2021-20224, only affected Ubuntu 20.04 ESM, while CVE-2021-20245, CVE-2021-3574, CVE-2021-4219 an…

    first Nov 24, 2022
  • Medium max 5.9
    USN-5734-1 8 CVEs

    freerdp2 vulnerabilities

    It was discovered that FreeRDP incorrectly handled certain data lenghts. A malicious server could use this issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.…

    first Nov 22, 2022
  • Medium max 6.5
    USN-5855-1 2 CVEs

    imagemagick vulnerabilities

    It was discovered that ImageMagick incorrectly handled certain PNG images. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause ImageMagick to stop responding, resulting in a denial of…

    first Feb 9, 2023
  • Medium max 5.3
    USN-5897-1 2 CVEs

    openjdk-17, openjdk-19, openjdk-lts vulnerabilities

    Juraj Somorovsky, Marcel Maehren, Nurullah Erinola, and Robert Merget discovered that the DTLS implementation in the JSSE subsystem of OpenJDK did not properly restrict handshake initiation requests from clients. A remote attacker could possibly use this to c…

    first Feb 28, 2023
  • Medium max 6.5
    USN-5852-1 1 CVE

    swift vulnerability

    It was discovered that OpenStack Swift incorrectly handled certain XML files. A remote authenticated user could possibly use this issue to obtain arbitrary file contents containing sensitive information from the server.

    first Feb 9, 2023
  • Medium max 5.7
    USN-5835-4 1 CVE

    cinder vulnerability

    USN-5835-1 fixed vulnerabilities in Cinder. This update provides the corresponding updates for Ubuntu 18.04 LTS. In addition, a regression was fixed for Ubuntu 20.04 LTS. Original advisory details: Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Ra…

    first Feb 9, 2023
  • Medium max 5.7
    USN-5835-3 1 CVE

    nova vulnerability

    Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that Nova incorrectly handled VMDK image processing. An authenticated attacker could possibly supply a specially crafted VMDK flat image and obtain arbitrary files from the server co…

    first Jan 31, 2023
  • Medium max 5.7
    USN-5835-5 1 CVE

    nova vulnerability

    USN-5835-3 fixed vulnerabilities in Nova. This update provides the corresponding updates for Ubuntu 18.04 LTS. Original advisory details: Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that Nova incorrectly handled VMDK image pro…

    first Feb 9, 2023
  • Medium max 5.7
    USN-5835-2 1 CVE

    glance vulnerability

    Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that OpenStack Glance incorrectly handled VMDK image processing. An authenticated attacker could possibly supply a specially crafted VMDK flat image and obtain arbitrary files from t…

    first Jan 31, 2023
  • Medium max 5.5
    USN-5786-1 1 CVE

    nautilus vulnerability

    It was discovered that GNOME Files incorrectly handled certain filenames. An attacker could possibly use this issue to cause GNOME Files to crash, leading to a denial of service.

    first Jan 5, 2023
  • Medium max 5.9
    USN-5697-1 1 CVE

    barbican vulnerability

    Douglas Mendizabal discovered that Barbican incorrectly handled certain query strings. A remote attacker could possibly use this issue to bypass the access policy.

    first Oct 25, 2022
  • Medium max 6.5
    USN-5696-1 16 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.31 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. Ubuntu 18.04 LTS has been updated to MySQL 5.7.40. In additi…

    first Oct 24, 2022
  • Medium max 4.3
    USN-5542-1 6 CVEs

    samba vulnerabilities

    It was discovered that Samba did not handle MaxQueryDuration when being used in AD DC configurations, contrary to expectations. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3670) Luke Howard discovered that Samba incorrectly handled certain restrictio…

    first Aug 1, 2022
  • Medium max 6.5
    USN-5400-1 23 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.29 in Ubuntu 20.04 LTS, Ubuntu 21.10, and Ubuntu 22.04 LTS. Ubuntu 18.04 LTS has been updated to MySQL 5.…

    first May 3, 2022
  • Medium max 5.9
    USN-5351-1 1 CVE

    paramiko vulnerability

    Jan Schejbal discovered that Paramiko incorrectly handled permissions when writing private key files. A local attacker could possibly use this issue to gain access to private keys.

    first Mar 28, 2022
  • Medium max 5.3
    USN-5313-1 15 CVEs

    openjdk-lts, openjdk-17 vulnerabilities

    It was discovered that OpenJDK incorrectly handled deserialization filters. An attacker could possibly use this issue to insert, delete or obtain sensitive information. (CVE-2022-21248) It was discovered that OpenJDK incorrectly read uncompressed TIFF files. …

    first Mar 7, 2022
  • Medium max 5.4
    USN-5067-1 4 CVEs

    sssd vulnerabilities

    Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10852) It was discovered that SSSD incor…

    first Sep 8, 2021
  • Medium max 6.5
    USN-5155-1 3 CVEs

    bluez vulnerabilities

    It was discovered that BlueZ incorrectly handled the Discoverable status when a device is powered down. This could result in devices being powered up discoverable, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 2…

    first Nov 23, 2021
  • Medium max 6.1
    USN-5013-1 2 CVEs

    systemd vulnerabilities

    It was discovered that systemd incorrectly handled certain mount paths. A local attacker could possibly use this issue to cause systemd to crash, resulting in a denial of service. (CVE-2021-33910) Mitchell Frank discovered that systemd incorrectly handled DHC…

    first Jul 20, 2021
  • Medium max 5.9
    USN-5038-1 2 CVEs

    postgresql-10, postgresql-12, postgresql-13 vulnerabilities

    It was discovered that the PostgresQL planner could create incorrect plans in certain circumstances. A remote attacker could use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly obtain sensitive information from memory. T…

    first Aug 12, 2021
  • Medium max 6.5
    USN-5181-1 2 CVEs

    jqueryui vulnerability

    It was discovered that jQuery UI did not properly validate the values from untrusted sources. An attacker could use this vulnerability to cause a crash or possibly execute arbitrary code. This issue affected only Ubuntu 18.04 ESM and Ubuntu 20.4 ESM. (CVE-202…

    first Sep 9, 2022
  • Medium max 5.8
    USN-5154-1 2 CVEs

    freerdp2 vulnerabilities

    It was discovered that FreeRDP incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2021-41159) It was discovered that FreeRDP incorrectly handled certain connections. An attacker could…

    first Nov 23, 2021
  • Medium max 6.5
    USN-5098-1 1 CVE

    node-bl vulnerability

    It was discovered that bl didn't properly sanitize the inputs. An attacker could use this to leak sensitive information.

    first Sep 30, 2021
  • Medium max 6.8
    USN-5105-1 1 CVE

    python-bottle vulnerability

    It was discovered that Bottle incorrectly handled certain inputs. An attacker could possibly use this issue to cache malicious requests.

    first Oct 6, 2021
  • Medium max 5.9
    USN-5022-2 2 CVEs

    mariadb-10.3, mariadb-10.5 vulnerabilities

    USN-5022-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2021-2372 and CVE-2021-2389 in MariaDB 10.3 and 10.5. In addition to security fixes, the updated package contain bug fixes, new features, and possibly inc…

    first Aug 13, 2021
  • Medium max 6.0
    USN-5022-1 31 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.26 in Ubuntu 20.04 LTS and Ubuntu 21.04. Ubuntu 18.04 LTS has been updated to MySQL 5.7.35. In addition t…

    first Jul 26, 2021
  • Medium max 6.2
    USN-5019-1 3 CVEs

    nvidia-graphics-drivers-390, nvidia-graphics-drivers-418-server, nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-460, nvidia-graphics-drivers-460-server, nvidia-graphics-drivers-470 vulnerabilities

    It was discovered that an assert() could be triggered in the NVIDIA graphics drivers. A local attacker could use this to cause a denial of service. (CVE-2021-1093) It was discovered that the NVIDIA graphics drivers permitted an out-of-bounds array access. A l…

    first Jul 21, 2021
  • Medium max 6.6
    USN-4935-1 2 CVEs

    nvidia-graphics-drivers-390, nvidia-graphics-drivers-418-server, nvidia-graphics-drivers-450, nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-460, nvidia-graphics-drivers-460-server vulnerabilities

    It was discovered that the NVIDIA GPU display driver for the Linux kernel incorrectly performed access control. A local attacker could use this issue to cause a denial of service, expose sensitive information, or escalate privileges. (CVE-2021-1076) It was di…

    first May 4, 2021
  • Medium max 5.3
    USN-4892-1 1 CVE

    openjdk-8, openjdk-lts vulnerability

    It was discovered that OpenJDK incorrectly verified Jar signatures. An attacker could possibly use this issue to bypass intended security restrictions when using Jar files signed with a disabled algorithm.

    first Apr 27, 2021
  • Medium max 5.3
    USN-4902-1 1 CVE

    python-django vulnerability

    Dennis Brinkrolf discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwrite files in unexpected directories.

    first Apr 6, 2021
  • Medium max 6.3
    USN-4881-1 1 CVE

    containerd vulnerability

    It was discovered that containerd incorrectly handled certain environment variables. Contrary to expectations, a container could receive environment variables defined for a different container, possibly containing sensitive information.

    first Mar 17, 2021
  • Medium max 5.9
    USN-4858-1 2 CVEs

    gradle vulnerabilities

    It was discovered that Gradle used an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins were used. A remote unauthenticated attacker could possibly use this issue to perform a machine-in-the-middle attack. …

    first Mar 15, 2021
  • Medium max 4.2
    USN-4834-1 1 CVE

    prosody vulnerability

    It was discovered that Prosody incorrectly validated the virtual host associated with a user session across stream restarts. A remote attacker could use this issue to gain unintended access to resources.

    first Mar 15, 2021
  • Medium max 4.4
    USN-4731-1 1 CVE

    junit4 vulnerability

    It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could possibly use this issue to obtain sensitive information.

    first Feb 10, 2021
  • Medium max 5.0
    USN-4467-1 13 CVEs

    qemu vulnerabilities

    Ziming Zhang and VictorV discovered that the QEMU SLiRP networking implementation incorrectly handled replying to certain ICMP echo requests. An attacker inside a guest could possibly use this issue to leak host memory to obtain sensitive information. This is…

    first Aug 19, 2020
  • Medium max 6.5
    USN-4202-1 9 CVEs

    thunderbird vulnerabilities

    It was discovered that a specially crafted S/MIME message with an inner encryption layer could be displayed as having a valid signature in some circumstances, even if the signer had no access to the encrypted message. An attacker could potentially exploit thi…

    first Nov 26, 2019
  • Medium max 5.5
    USN-4382-1 14 CVEs

    freerdp vulnerabilities

    It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jun 4, 2020
  • Medium max 5.5
    USN-4379-1 19 CVEs

    freerdp2 vulnerabilities

    It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly exeucte arbitrary code.

    first Jun 1, 2020
  • Medium max 6.5
    USN-4244-1 3 CVEs

    samba vulnerabilities

    It was discovered that Samba did not automatically replicate ACLs set to inherit down a subtree on AD Directory, contrary to expectations. This issue was only addressed in Ubuntu 18.04 LTS, Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-14902) Robert Święcki discov…

    first Jan 21, 2020