Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

1,181 results · Clear filters · Feed

  • Medium max 5.5
    USN-4336-1 44 CVEs

    binutils vulnerabilities

    It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or pos…

    first Apr 22, 2020
  • Medium max 5.9
    USN-4891-1 1 CVE

    openssl vulnerability

    It was discovered that OpenSSL incorrectly handled certain renegotiation ClientHello messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service.

    first Mar 25, 2021
  • Medium max 5.5
    USN-4603-1 6 CVEs

    mariadb-10.1, mariadb-10.3 vulnerabilities

    It was discovered that MariaDB didn't properly validate the content of a packet received from a server. A remote attacker could use this vulnerability to sent a specialy crafted file to cause a denial of service. (CVE-2020-13249) It was discovered that MariaD…

    first Oct 27, 2020
  • Medium max 5.3
    USN-4607-1 8 CVEs

    openjdk-8, openjdk-lts vulnerabilities

    It was discovered that OpenJDK incorrectly handled deserializing Proxy class objects with many interfaces. A remote attacker could possibly use this issue to cause a denial of service (memory consumption) via a specially crafted input. (CVE-2020-14779) Sergey…

    first Oct 27, 2020
  • Medium max 4.9
    USN-4586-1 1 CVE

    php-imagick vulnerability

    It was discovered that PHP ImageMagick extension didn't check the address used by an array. An attacker could use this issue to cause PHP ImageMagick to crash, resulting in a denial of service.

    first Oct 20, 2020
  • Medium max 6.1
    USN-4560-1 1 CVE

    ruby-gon vulnerability

    It was discovered that Gon gem did not properly escape certain input. An attacker could use this vulnerability to execute a cross-site scripting (XSS) attack.

    first Sep 30, 2020
  • Medium max 5.3
    USN-4571-1 1 CVE

    ruby-rack-cors vulnerability

    It was discovered that rack-cors did not properly handle relative file paths. An attacker could use this vulnerability to access arbitrary files.

    first Oct 5, 2020
  • Medium max 4.8
    USN-4574-1 1 CVE

    golang-github-seccomp-libseccomp-golang vulnerability

    It was discovered that libseccomp-golang did not properly generate BPFs. If a process were running under a restrictive seccomp filter that specified multiple syscall arguments, the application could potentially bypass the intended restrictions put in place by…

    first Oct 7, 2020
  • Medium max 6.5
    USN-4570-1 1 CVE

    python-urllib3 vulnerability

    It was discovered that urllib3 incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection.

    first Oct 5, 2020
  • Medium max 5.5
    USN-4564-1 2 CVEs

    tika vulnerabilities

    It was discovered that Apache Tika can have an excessive memory usage by using a crafted or corrupt PSD file. An attacker could use it to cause a denial of service (crash). (CVE-2020-1950, CVE-2020-1951)

    first Oct 5, 2020
  • Medium max 5.3
    USN-4516-1 1 CVE

    gnupg2 vulnerability

    It was discovered that GnuPG signatures could be forged when the SHA-1 algorithm is being used. This update removes validating signatures based on SHA-1 that were generated after 2019-01-19. In environments where this is still required, a new option --allow-w…

    first Sep 17, 2020
  • Medium max 6.1
    USN-4522-1 1 CVE

    novnc vulnerability

    It was discovered that noVNC did not properly manage certain messages, resulting in the remote VNC server injecting arbitrary HTML into the noVNC web page. An attacker could use this issue to conduct cross-site scripting (XSS) attacks. (CVE-2017-18635)

    first Sep 21, 2020
  • Medium max 5.4
    USN-4498-1 1 CVE

    ruby-loofah vulnerability

    It was discovered that Loofah does not properly sanitize JavaScript in sanitized output. An attacker could possibly use this issue to perform XSS attacks. (CVE-2019-15587)

    first Sep 15, 2020
  • Medium max 6.5
    USN-4350-1 25 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.80 in Ubuntu 19.10 and Ubuntu 20.04 LTS. Ubuntu 16.04 LTS and Ubuntu 18.04 LTS have been updated to MySQL…

    first May 4, 2020
  • Medium max 6.5
    USN-4420-1 1 CVE

    cinder, python-os-brick vulnerability

    David Hill and Eric Harney discovered that Cinder and os-brick incorrectly handled ScaleIO backend credentials. An attacker could possibly use this issue to expose sensitive information.

    first Jul 7, 2020
  • Medium max 5.9
    USN-4250-2 1 CVE

    mariadb-10.1, mariadb-10.3 vulnerability

    It was discovered that an unspecified vulnerability existed in the C API component of MariaDB. An attacker could use this to cause a denial of service for MariaDB clients. MariaDB has been updated to 10.3.22 in Ubuntu 19.10 and 10.1.44 in Ubuntu 18.04 LTS. In…

    first Feb 6, 2020
  • Medium max 6.5
    USN-4250-1 14 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.19 in Ubuntu 19.10. Ubuntu 16.04 LTS and Ubuntu 18.04 LTS have been updated to MySQL 5.7.29. In addition …

    first Jan 27, 2020
  • Medium max 6.5
    USN-4165-1 13 CVEs

    firefox vulnerabilities

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, bypass same-origin restrictions, con…

    first Oct 23, 2019
  • Medium max 5.9
    USN-3999-1 4 CVEs

    gnutls28 vulnerabilities

    Eyal Ronen, Kenneth G. Paterson, and Adi Shamir discovered that GnuTLS was vulnerable to a timing side-channel attack known as the "Lucky Thirteen" issue. A remote attacker could possibly use this issue to perform plaintext-recovery attacks via analysis of ti…

    first May 30, 2019
  • Medium max 6.5
    USN-4034-1 28 CVEs

    imagemagick vulnerabilities

    It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

    first Jun 25, 2019
  • Medium max 5.3
    USN-3759-1 3 CVEs

    libtirpc vulnerabilities

    Aldy Hernandez discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-4429) It was discovered that libtirpc…

    first Sep 5, 2018
  • Medium max 6.3
    USN-4170-1 1 CVE

    whoopsie vulnerability

    Kevin Backhouse discovered Whoopsie incorrectly handled very large crash reports. A local attacker could possibly use this issue to cause a denial of service, expose sensitive information or execute code as the whoopsie user.

    first Oct 30, 2019
  • Medium max 6.5
    USN-4132-1 1 CVE

    expat vulnerability

    It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.

    first Sep 12, 2019
  • Medium max 6.5
    USN-4132-2 1 CVE

    expat vulnerability

    USN-4132-1 fixed a vulnerability in Expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use t…

    first Sep 12, 2019
  • Medium max 6.1
    USN-4043-1 2 CVEs

    python-django vulnerabilities

    It was discovered that Django incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10 and Ubuntu 19.04. (CVE-2019-12308) Gavin Wahl discovered that Django…

    first Jul 1, 2019
  • Medium max 6.8
    USN-4716-1 25 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.23 in Ubuntu 20.04 LTS and Ubuntu 20.10. Ubuntu 16.04 LTS and Ubuntu 18.04 LTS have been updated to MySQL…

    first Feb 1, 2021
  • Medium max 6.3
    USN-3892-1 1 CVE

    gdm3 vulnerability

    Burghard Britzke discovered that GDM incorrectly handled certain configurations. An attacker could possibly use this issue to get unauthorized access to a different user.

    first Feb 20, 2019
  • Medium max 4.3
    USN-3787-1 1 CVE

    tomcat7, tomcat8 vulnerability

    It was discovered that Tomcat incorrectly handled returning redirects to a directory. A remote attacker could possibly use this issue with a specially crafted URL to redirect to arbitrary URIs.

    first Oct 10, 2018
  • Medium max 5.7
    USN-5835-1 1 CVE

    cinder vulnerability

    Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that Cinder incorrectly handled VMDK image processing. An authenticated attacker could possibly supply a specially crafted VMDK flat image and obtain arbitrary files from the server …

    first Jan 31, 2023
  • Medium max 5.3
    USN-5021-1 3 CVEs

    curl vulnerabilities

    Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line. Uninitialized data possibly containing sensitive information could be sent to the remote server, contrary to expectatio…

    first Jul 22, 2021
  • Medium max 6.5
    USN-3441-1 5 CVEs

    curl vulnerabilities

    Daniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LT…

    first Oct 10, 2017
  • Medium max 5.3
    USN-8086-1 1 CVE

    freetype vulnerability

    It was discovered that FreeType did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to leak sensitive information.

    first Mar 12, 2026
  • Medium max 5.5
    USN-7961-1 1 CVE

    erlang vulnerability

    It was discovered that Erlang incorrectly validated peer certificates when incorrect extended key usage was presented. A remote attacker could possibly use this issue to bypass SSL key usage restrictions.

    first Jan 14, 2026
  • Medium max 5.5
    USN-7993-1 2 CVEs

    libpng1.6 vulnerabilities

    It was discovered that libpng incorrectly handled memory when processing certain malformed PNG files. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in…

    first Feb 2, 2026
  • Medium max 6.9
    USN-7916-2 1 CVE

    python-apt regression

    USN-7916-1 fixed a vulnerability in python-apt. The update had a PEP 440 incompatible version. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Julian Andres Klode discovered that python-apt incorrectly handled deb…

    first Jan 15, 2026
  • Medium max 5.1
    USN-7912-1 1 CVE

    cups vulnerability

    Johannes Meixner and Paul Zirnik discovered that CUPS incorrectly handled clients that send messages slowly. A remote attacker could possibly use this issue to cause CUPS to stop responding, resulting in a denial of service. (CVE-2025-58436) In addition, this…

    first Dec 4, 2025
  • Medium max 5.9
    USN-7925-1 1 CVE

    c-ares vulnerability

    It was discovered that c-ares incorrectly handled terminating certain queries after a maximum number of attempts. An attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service.

    first Dec 11, 2025
  • Medium max 6.1
    USN-7858-1 1 CVE

    poppler vulnerability

    It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a crash.

    first Nov 5, 2025
  • Medium max 4.0
    USN-7877-1 2 CVEs

    libcupsfilters vulnerabilities

    It was discovered that libcupsfilters incorrectly handled certain malformed TIFF image files. A remote attacker could use this issue to cause libcupsfilters to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-57812) It wa…

    first Nov 20, 2025
  • Medium max 6.9
    USN-7751-1 1 CVE

    sqlite3 vulnerability

    It was discovered that the FTS5 SQLite extension incorrectly calculated certain array lengths. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Sep 15, 2025