Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

1,181 results · Clear filters · Feed

  • Medium max 5.6
    USN-3531-1 1 CVE

    intel-microcode update

    It was discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including…

    first Jan 11, 2018
  • Medium max 6.1
    USN-3463-1 1 CVE

    python-werkzeug vulnerability

    It was discovered that Werkzeug did not properly handle certain web scripts. A remote attacker could use this to inject arbitrary code via a field that contains an exception message.

    first Oct 25, 2017
  • Medium max 6.8
    USN-3448-1 1 CVE

    keystone vulnerability

    Boris Bobrov discovered that OpenStack Keystone incorrectly handled federation mapping when there are rules in which group-based assignments are not used. A remote authenticated user may receive all the roles assigned to a project regardless of the federation…

    first Oct 11, 2017
  • Medium max 5.4
    USN-3447-1 1 CVE

    horizon vulnerability

    Beth Lancaster and Brandon Sawyers discovered that OpenStack Horizon was incorrect protected against cross-site scripting (XSS) attacks. A remote authenticated user could use this issue to inject web script or HTML in a dashboard form.

    first Oct 11, 2017
  • Medium max 4.3
    USN-3446-1 3 CVEs

    glance vulnerabilities

    Hemanth Makkapati discovered that OpenStack Glance incorrectly handled access restrictions. A remote authenticated user could use this issue to change the status of images, contrary to access restrictions. (CVE-2015-5251) Mike Fedosin and Alexei Galkin discov…

    first Oct 11, 2017
  • Medium max 4.4
    USN-3312-2 15 CVEs

    linux-lts-xenial vulnerabilities

    USN-3312-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the netfilter netlink i…

    first Jun 7, 2017
  • Medium max 6.2
    USN-3294-1 3 CVEs

    bash vulnerabilities

    Bernd Dietzel discovered that Bash incorrectly expanded the hostname when displaying the prompt. If a remote attacker were able to modify a hostname, this flaw could be exploited to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.…

    first May 17, 2017
  • Medium max 5.5
    USN-3276-1 2 CVEs

    shadow vulnerabilities

    Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain privileges via crafted input. (CVE-2016-6252) Tobias Stöckmann discovered a race condition in su. A local attacker coul…

    first May 5, 2017
  • Medium max 6.1
    USN-3254-1 2 CVEs

    python-django vulnerabilities

    It was discovered that Django incorrectly handled numeric redirect URLs. A remote attacker could possibly use this issue to perform XSS attacks, and to use a Django server as an open redirect. (CVE-2017-7233) Phithon Gong discovered that Django incorrectly ha…

    first Apr 4, 2017
  • Medium max 6.1
    USN-3137-1 3 CVEs

    moin vulnerabilities

    It was discovered that MoinMoin did not properly sanitize certain inputs, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a …

    first Nov 23, 2016
  • Medium max 6.1
    USN-3039-1 1 CVE

    python-django vulnerability

    It was discovered that Django incorrectly handled the admin's add/change related popup. A remote attacker could possibly use this issue to perform a cross-site scripting attack.

    first Jul 19, 2016
  • Medium max 5.7
    USN-2618-1 1 CVE

    python-dbusmock vulnerability

    It was discovered that python-dbusmock incorrectly handled template loading from shared directories. A local attacker could possibly use this issue to execute arbitrary code.

    first May 21, 2015
  • Medium max 5.3
    USN-2382-1 2 CVEs

    requests vulnerabilities

    Jakub Wilk discovered that Requests incorrectly reused authentication credentials after being redirected. An attacker could possibly use this issue to obtain authentication credentials intended for another site. (CVE-2014-1829, CVE-2014-1830)

    first Oct 14, 2014
  • Medium max 6.5
    USN-2324-1 5 CVEs

    keystone vulnerabilities

    Steven Hardy discovered that OpenStack Keystone did not properly handle chained delegation. A remove authenticated attacker could use this to gain privileges by creating a new token with additional roles. (CVE-2014-3476) Jamie Lennox discovered that OpenStack…

    first Aug 21, 2014
  • Medium max 6.1
    USN-2217-1 1 CVE

    lxml vulnerability

    It was discovered that the lxml.html.clean module incorrectly stripped control characters. An attacked could potentially exploit this to conduct cross-site scripting (XSS) attacks.

    first May 21, 2014
  • Medium max 5.9
    USN-7520-2 1 CVE

    postgresql-17 vulnerability

    USN-7520-1 fixed a vulnerability in PostgreSQL. This update provides the corresponding updates for Ubuntu 25.04. Original advisory details: It was discovered that PostgreSQL incorrectly handled the GB18030 encoding. An attacker could possibly use this issue t…

    first May 21, 2025
  • Medium max 5.6
    USN-7848-1 2 CVEs

    amd64-microcode vulnerabilities

    Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores. A local attacker could possibly use this issue to expose sensitive infor…

    first Oct 29, 2025
  • Medium max 6.8
    USN-7431-2 1 CVE

    haproxy vulnerability

    USN-7431-1 fixed a vulnerability in HAProxy. This update provides the corresponding update for Ubuntu 25.04. Original advisory details: Aleandro Prudenzano and Edoardo Geraci discovered that HAProxy incorrectly handled certain uncommon configurations that rep…

    first Apr 23, 2025
  • Medium max 4.9
    USN-7564-1 1 CVE

    samba vulnerability

    It was discovered that Samba incorrectly handled certain group membership changes when using Kerberos authentication. A remote user could possibly use this issue to continue to access resources after being removed by an administrator.

    first Jun 10, 2025
  • Medium max 6.9
    USN-7777-1 1 CVE

    pcre2 vulnerability

    It was discovered that PCRE2 incorrectly handled the Scan SubString verb. An attacker could possibly use this issue to cause applications using PCRE2 to expose sensitive information.

    first Sep 25, 2025
  • Medium max 6.7
    USN-7763-1 1 CVE

    rabbitmq-server vulnerability

    It was discovered that RabbitMQ Server incorrectly included authorization headers when logging. A local attacker could possibly use this issue to obtain sensitive information.

    first Sep 23, 2025