Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

1,181 results · Clear filters · Feed

  • Medium max 5.5
    USN-4451-2 1 CVE

    ppp vulnerability

    USN-4451-1 fixed a vulnerability in ppp. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Thomas Chauchefoin working with Trend Micro´s Zero Day Initiative, discovered that ppp incorrectly han…

    first Aug 6, 2020
  • Medium max 5.5
    USN-4451-1 1 CVE

    ppp vulnerability

    Thomas Chauchefoin working with Trend Micro´s Zero Day Initiative, discovered that ppp incorrectly handled module loading. A local attacker could use this issue to load arbitrary kernel modules and possibly execute arbitrary code.

    first Aug 4, 2020
  • Medium max 5.5
    USN-4382-2 13 CVEs

    freerdp vulnerabilities

    It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Nov 26, 2020
  • Medium max 6.5
    USN-4371-1 2 CVEs

    libvirt vulnerabilities

    It was discovered that libvirt incorrectly handled an active pool without a target path. A remote attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2020-10703) It was discovered that libvirt incorrectly h…

    first May 21, 2020
  • Medium max 5.3
    USN-4375-1 1 CVE

    php5, php7.0, php7.2, php7.3, php7.4 vulnerability

    It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.

    first May 27, 2020
  • Medium max 6.5
    USN-4304-1 1 CVE

    ceph vulnerability

    Or Friedman discovered that Ceph incorrectly handled disconnects. A remote authenticated attacker could possibly use this issue to cause Ceph to consume resources, leading to a denial of service.

    first Mar 17, 2020
  • Medium max 6.5
    USN-4279-1 3 CVEs

    php5, php7.0, php7.2, php7.3 vulnerabilities

    It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2015-9253) It was discovered that PH…

    first Feb 17, 2020
  • Medium max 5.3
    USN-4327-1 1 CVE

    libssh vulnerability

    Yasheng Yang discovered that libssh incorrectly handled AES-CTR ciphers. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service.

    first Apr 9, 2020
  • Medium max 4.7
    USN-4247-1 2 CVEs

    python-apt vulnerabilities

    It was discovered that python-apt would still use MD5 hashes to validate certain downloaded packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages. (CVE-2019-15795) I…

    first Jan 22, 2020
  • Medium max 5.1
    USN-4271-1 1 CVE

    mesa vulnerability

    Tim Brown discovered that Mesa incorrectly handled shared memory permissions. A local attacker could use this issue to obtain and possibly alter sensitive information belonging to another user.

    first Feb 6, 2020
  • Medium max 4.8
    USN-4239-1 4 CVEs

    php5, php7.0, php7.2, php7.3 vulnerabilities

    It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, 16.04 LTS, 18.04 LTS, 19.04 and 19.10. (CVE-2019-11045) It was discovered that PHP…

    first Jan 15, 2020
  • Medium max 4.7
    USN-4247-3 2 CVEs

    python-apt vulnerabilities

    USN-4247-1 fixed several vulnerabilities in python-apt. This update provides the corresponding updates for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that python-apt would still use MD5 hashes to validate certain downl…

    first Jan 23, 2020
  • Medium max 5.3
    USN-4167-1 3 CVEs

    samba vulnerabilities

    Michael Hanselmann discovered that the Samba client code incorrectly handled path separators. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause the client to access local pathnames instead of network…

    first Oct 29, 2019
  • Medium max 5.3
    USN-4167-2 2 CVEs

    samba vulnerabilities

    USN-4167-1 fixed several vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Michael Hanselmann discovered that the Samba client code incorrectly handled path separators…

    first Oct 29, 2019
  • Medium max 4.8
    USN-4097-1 2 CVEs

    php7.0, php7.2 vulnerabilities

    It was discovered that PHP incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2019-11041, CVE-2019-11042)

    first Aug 13, 2019
  • Medium max 6.5
    USN-4056-1 7 CVEs

    exiv2 vulnerabilities

    It was discovered that Exiv2 incorrectly handled certain PSD files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19107, CVE-2018-19108) It was discovered that Exiv2 incorrectly handled certain PNG files. An attacker could …

    first Jul 15, 2019
  • Medium max 4.8
    USN-4097-2 2 CVEs

    php5 vulnerabilities

    USN-4097-1 fixed several vulnerabilities in php5. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain images. An attacker could possibly use…

    first Aug 13, 2019
  • Medium max 6.5
    USN-4052-1 1 CVE

    whoopsie vulnerability

    Kevin Backhouse discovered Whoopsie incorrectly handled very large crash reports. A local attacker could possibly use this issue to cause a denial of service or expose sensitive information.

    first Jul 9, 2019
  • Medium max 5.3
    USN-4041-1 1 CVE

    linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon update

    USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. Unfortunately, the update introduced a regression that interfered with networking applications that setup very low SO_SNDBUF values. This update fixes the problem. We apologize for the inconveni…

    first Jun 29, 2019
  • Medium max 5.9
    USN-4026-1 1 CVE

    bind9 vulnerability

    It was discovered that Bind incorrectly handled certain malformed packets. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.

    first Jun 20, 2019
  • Medium max 4.8
    USN-4009-1 3 CVEs

    php7.0, php7.2 vulnerabilities

    It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11036) It was discovered that PHP i…

    first Jun 5, 2019
  • Medium max 4.8
    USN-4009-2 2 CVEs

    php5 vulnerabilities

    USN-4009-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly decoding certain MIME headers. A remote attacker could …

    first Jun 5, 2019
  • Medium max 4.8
    USN-3953-2 2 CVEs

    php5 vulnerabilities

    USN-3953-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote atta…

    first May 1, 2019
  • Medium max 4.5
    USN-3938-1 1 CVE

    systemd vulnerability

    Jann Horn discovered that pam_systemd created logind sessions using some parameters from the environment. A local attacker could exploit this in order to spoof the active session and gain additional PolicyKit privileges.

    first Apr 8, 2019
  • Medium max 6.5
    USN-3973-1 1 CVE

    isc-dhcp vulnerability

    It was discovered that DHCP, when built with a mismatched external BIND library, incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause DHCP to crash, resulting in a denial of service.

    first May 13, 2019
  • Medium max 4.8
    USN-3953-1 2 CVEs

    php7.0, php7.2 vulnerabilities

    It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Apr 23, 2019
  • Medium max 4.2
    USN-3939-1 1 CVE

    samba vulnerability

    Michael Hanselmann discovered that Samba incorrectly handled registry files. A remote attacker could possibly use this issue to create new registry files outside of the share, contrary to expectations.

    first Apr 8, 2019
  • Medium max 5.8
    USN-3909-1 1 CVE

    libvirt vulnerability

    It was discovered that libvirt incorrectly handled waiting for certain agent events. An attacker inside a guest could possibly use this issue to cause libvirtd to stop responding, resulting in a denial of service.

    first Mar 14, 2019
  • Medium max 4.5
    USN-3856-1 1 CVE

    gnome-bluetooth vulnerability

    Chris Marchesi discovered that BlueZ incorrectly handled disabling Bluetooth visibility. A remote attacker could possibly pair to devices, contrary to expectations. This update adds a workaround to GNOME Bluetooth to fix the issue.

    first Jan 14, 2019
  • Medium max 6.5
    USN-3852-1 9 CVEs

    exiv2 vulnerabilities

    It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. CVE-2017-9239 only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-11591, CVE-2017-11683, CVE-2017-14859, CVE-201…

    first Jan 10, 2019
  • Medium max 6.7
    USN-3843-1 1 CVE

    pixman vulnerability

    It was discovered that pixman incorrectly handled the general_composite_rect function. A remote attacker could use this issue to cause pixman to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Dec 11, 2018
  • Medium max 6.5
    USN-3827-1 3 CVEs

    samba vulnerabilities

    Florian Stuelpner discovered that Samba incorrectly handled CNAME records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2018-14629) Alex MacCuish discovered that Samba incorrectly handled memory when c…

    first Nov 27, 2018
  • Medium max 6.5
    USN-3817-1 5 CVEs

    python2.7, python3.4, python3.5 vulnerabilities

    It was discovered that Python incorrectly handled large amounts of data. A remote attacker could use this issue to cause Python to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubunt…

    first Nov 13, 2018
  • Medium max 4.4
    USN-3805-1 3 CVEs

    curl vulnerabilities

    Harry Sintonen discovered that curl incorrectly handled SASL authentication. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-16839) Brian Carpenter discovered that …

    first Oct 31, 2018
  • Medium max 5.4
    USN-4217-1 2 CVEs

    samba vulnerabilities

    Andreas Oster discovered that the Samba DNS management server incorrectly handled certain records. An authenticated attacker could possibly use this issue to crash Samba, resulting in a denial of service. (CVE-2019-14861) Isaac Boukris discovered that Samba d…

    first Dec 10, 2019
  • Medium max 5.4
    USN-4217-2 2 CVEs

    samba vulnerabilities

    USN-4217-1 fixed several vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Andreas Oster discovered that the Samba DNS management server incorrectly handled certain records. An authenticat…

    first Dec 11, 2019
  • Medium max 4.7
    USN-3717-1 4 CVEs

    policykit-1 vulnerabilities

    Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid object paths. A local attacker could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3218) …

    first Jul 16, 2018
  • Medium max 6.1
    USN-3709-1 1 CVE

    xapian-core vulnerability

    It was discovered that Xapian-core incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code.

    first Jul 10, 2018
  • Medium max 5.4
    USN-3738-1 4 CVEs

    samba vulnerabilities

    Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-10858)…

    first Aug 14, 2018
  • Medium max 5.5
    USN-3698-1 10 CVEs

    linux vulnerabilities

    It was discovered that the nested KVM implementation in the Linux kernel in some situations did not properly prevent second level guests from reading and writing the hardware CR8 register. A local attacker in a guest could use this to cause a denial of servic…

    first Jul 2, 2018