Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

1,181 results · Clear filters · Feed

  • Medium max 5.9
    USN-7876-1 1 CVE

    imagemagick vulnerabilities

    It was discovered that ImageMagick did not properly handle memory when encoding BMP images. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue exists due to…

    first Nov 20, 2025
  • Medium max 4.7
    USN-7849-1 1 CVE

    libssh vulnerability

    Philippe Antoine discovered that libssh did not properly manage memory when calculating a session id during the key exchange process. An attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service.

    first Nov 4, 2025
  • Medium max 6.5
    USN-7844-1 1 CVE

    libyaml-syck-perl vulnerability

    It was discovered that YAML::Syck did not properly handle parsing YAML files. An attacker could possibly use this issue to expose sensitive information.

    first Oct 28, 2025
  • Medium max 5.5
    USN-7828-1 2 CVEs

    python-ldap vulnerabilities

    It was discovered that Python LDAP incorrectly handled special characters in the special character filtering function. A remote attacker could possibly use this issue to perform LDAP injection attacks. (CVE-2025-61911) Arad Inbar discovered that Python LDAP i…

    first Oct 20, 2025
  • Medium max 5.6
    USN-7827-1 3 CVEs

    gst-plugins-base1.0 vulnerabilities

    Shaun Mirani discovered that GStreamer Base Plugins did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service.

    first Oct 20, 2025
  • Medium max 4.2
    USN-7815-1 1 CVE

    vim vulnerabilities

    It was discovered that Vim incorrectly handled certain internal calls when scrolling a window. An attacker could possibly use this issue to cause a denial of service.

    first Oct 9, 2025
  • Medium max 4.0
    USN-7804-2 1 CVE

    squid, squid3 vulnerability

    USN-7804-1 fixed a vulnerability in Squid. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Squid incorrectly handled certain long SNMP OIDs. A remote …

    first Nov 4, 2025
  • Medium max 5.3
    USN-7780-1 4 CVEs

    qtbase-opensource-src vulnerabilities

    It was discovered that Qt did not correctly handle certain inputs when using the SQL ODBC driver plugin. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-24607) It was discovered that Qt did not correctly parse certain strict-…

    first Sep 28, 2025
  • Medium max 6.2
    USN-7773-1 7 CVEs

    gnuplot vulnerabilities

    ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-3359, CVE-2025-31178, CVE-2025-31179, CVE-2025-31181) ChenYiFan Liu discovered that Gnu…

    first Sep 25, 2025
  • Medium max 6.5
    USN-7759-1 1 CVE

    isc-kea vulnerabilities

    It was discovered that Kea DHCP did not correctly handle invalid hostnames. A remote attacker could possibly use this issue to cause a denial of service.

    first Sep 21, 2025
  • Medium max 6.9
    USN-7753-1 1 CVE

    python-xmltodict vulnerability

    Camilo Vera discovered that xmltodict parsed maliciously crafted XML input, contrary to expectations. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code.

    first Sep 16, 2025
  • Medium max 6.2
    USN-7743-1 1 CVE

    libxml2 vulnerability

    Nikita Sveshnikov discovered that libxml2 incorrectly handled recursion when processing XPath expressions. An attacker could possibly use this issue to cause a denial of service.

    first Sep 10, 2025
  • Medium max 6.5
    USN-7742-1 3 CVEs

    gnutls28 vulnerabilities

    It was discovered that GnuTLS incorrectly handled exporting Subject Alternative Name (SAN) entries containing an otherName. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. …

    first Sep 9, 2025
  • Medium max 5.5
    USN-7740-1 1 CVE

    libetpan vulnerability

    It was discovered that LibEtPan incorrectly handled memory when parsing IMAP STATUS responses. A remote attacker could possibly use this issue to cause LibEtPan to crash, resulting in a denial of service.

    first Sep 8, 2025
  • Medium max 6.3
    USN-7738-1 1 CVE

    ffmpeg vulnerability

    It was discovered that FFmpeg incorrectly handled the calculation of LPC order, which could lead to a stack-based buffer overflow. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service.

    first Sep 4, 2025
  • Medium max 5.9
    USN-7729-1 4 CVEs

    kdepim vulnerabilities

    Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jörg Schwenk discovered that the KMail application of KDE PIM could be made to leak the plaintext of S/MIME encrypted emails when retr…

    first Sep 2, 2025
  • Medium max 5.3
    USN-7718-1 1 CVE

    binutils vulnerability

    It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash.

    first Aug 26, 2025
  • Medium max 6.5
    USN-7708-1 1 CVE

    poppler vulnerability

    It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a denial of service.

    first Aug 20, 2025
  • Medium max 5.3
    USN-7707-1 4 CVEs

    tiff vulnerabilities

    It was discovered that LibTIFF incorrectly handled certain memory operations when using tiffmedian tool. An attacker could trick a user into processing a specially crafted tiff image file and potentially use this issue to cause a denial of service. (CVE-2025-…

    first Aug 20, 2025
  • Medium max 6.2
    USN-7697-1 2 CVEs

    aide vulnerabilities

    Rajesh Pangare discovered that AIDE incorrectly handled filenames. A local attacker could possibly use this issue to bypass the detection of malicious files. (CVE-2025-54389) Rajesh Pangare discovered that AIDE incorrectly handled extended file attributes. A …

    first Aug 14, 2025
  • Medium max 4.4
    USN-7688-1 4 CVEs

    cifs-utils vulnerabilities

    Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly use this issue to escalate privileges. (CVE-2020-14342) It was discovered that cifs-utils incorrectly used host cred…

    first Aug 7, 2025
  • Medium max 5.5
    USN-7687-1 2 CVEs

    poppler vulnerabilities

    Jieyong Ma discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (C…

    first Aug 6, 2025
  • Medium max 5.5
    USN-7660-1 4 CVEs

    fdkaac vulnerabilities

    It was discovered that fdkaac did not correctly handle certain input. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2022-36148) It was discovered …

    first Jul 22, 2025
  • Medium max 6.9
    USN-7658-1 2 CVEs 1 exploited

    drupal7 vulnerabilities

    It was discovered that Drupal incorrectly parsed untrusted HTML. A remote attacker could possibly use this issue to execute arbitrary code.

    first Jul 21, 2025
  • Medium max 5.9
    USN-7648-3 1 CVE

    php7.0, php7.2, php7.4 regression

    USN-7648-2 fixed vulnerabilities in PHP. The patch for CVE-2025-1735 caused a regression in php7.0, php7.2 and php7.4. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that PHP incorrectly handled…

    first Sep 4, 2025
  • Medium max 5.9
    USN-7648-2 3 CVEs

    php7.0, php7.2, php7.4 vulnerabilities

    USN-7648-1 fixed several vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled certain hostnames containin…

    first Aug 21, 2025
  • Medium max 6.3
    USN-7645-1 4 CVEs

    php7.0, php7.2 vulnerabilities

    It was discovered that PHP incorrectly parsed certain HTTP response headers. An attacker could possibly use this issue to cause incorrect MIME type parsing which could result in unexpected behavior. (CVE-2025-1217) It was discovered that PHP did not properly …

    first Jul 17, 2025
  • Medium max 6.9
    USN-7622-1 4 CVEs 1 exploited

    jquery vulnerabilities

    It was discovered that jQuery did not correctly handle HTML tags. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS. (CVE-2012-6708) It was discovered that jQuery did not correc…

    first Jul 8, 2025
  • Medium max 4.3
    USN-7614-1 4 CVEs

    pcs vulnerabilities

    Cedric Buissart discovered that pcs did not correctly handle certain parameters. An attacker could possibly use this issue to leak sensitive information or elevate their privileges. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-1086) Ondrej Mular disco…

    first Jul 2, 2025
  • Medium max 5.3
    USN-7599-1 2 CVEs

    python-urllib3 vulnerabilities

    Jacob Sandum discovered that urllib3 handled redirects even when they were explicitly disabled while using the PoolManager. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-50181) Illia Volochii discovered that urllib3 inco…

    first Jun 25, 2025
  • Medium max 6.1
    USN-7581-1 2 CVEs

    node-express vulnerabilities

    It was discovered that Express incorrectly handled certain URLs, leading to an open redirect attack. A remote attacker could possibly use this issue to perform phishing attacks. (CVE-2024-29041) Adam Korcz discovered that Express did not properly sanitize cer…

    first Jun 19, 2025
  • Medium max 6.1
    USN-7568-1 2 CVEs

    requests vulnerabilities

    Dennis Brinkrolf and Tobias Funke discovered that Requests did not correctly handle certain HTTP headers. A remote attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-32681) Juho Forsén di…

    first Jun 16, 2025
  • Medium max 6.4
    USN-7556-1 3 CVEs

    twitter-bootstrap3, twitter-bootstrap4 vulnerabilities

    It was discovered that Bootstrap did not correctly sanitize certain input in the carousel component. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6484, CVE-2024-6531) It was discovered that Bootstrap did …

    first Jun 5, 2025
  • Medium max 5.4
    USN-7551-1 1 CVE

    libvpx vulnerability

    It was discovered that libvpx did not properly manage memory. An attacker could possibly use this issue to cause applications using libvpx to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jun 3, 2025
  • Medium max 4.7
    USN-7545-1 1 CVE

    apport vulnerability

    Qualys discovered that Apport incorrectly handled metadata when processing application crashes. An attacker could possibly use this issue to leak sensitive information.

    first May 29, 2025
  • Medium max 5.9
    USN-7542-1 1 CVE

    krb5 vulnerability

    It was discovered that Kerberos allowed the usage of weak cryptographic standards. An attacker could possibly use this issue to expose sensitive information. This update introduces the allow_rc4 and allow_des3 configuration options, and disables the usage of …

    first May 28, 2025
  • Medium max 6.5
    USN-7538-1 5 CVEs

    ffmpeg vulnerabilities

    Simcha Kosman discovered that FFmpeg did not correctly handle certain return values. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubun…

    first May 28, 2025
  • Medium max 5.3
    USN-7527-1 1 CVE

    libfcgi-perl vulnerability

    It was discovered that libfcgi-perl incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

    first May 22, 2025
  • Medium max 6.1
    USN-7508-2 1 CVE

    open-vm-tools vulnerability

    USN-7508-1 fixed a vulnerability in Open VM Tools. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS Original advisory details: It was discovered that Open VM Tools incorrectly handled certain file operations. An attacker…

    first Jun 3, 2025
  • Medium max 6.5
    USN-7490-2 1 CVE

    libsoup2.4 regression

    USN-7490-1 fixed vulnerabilities in libsoup. It was discovered that the fix for CVE-2025-32912 was incomplete. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Tan Wei Chong discovered that libsoup incorrectly hand…

    first May 6, 2025