8,437 results · Feed
-
High max 7.5USN-5223-1 1 CVE
apache-log4j1.2 vulnerability
It was discovered that Apache Log4j 1.2 was vulnerable to deserialization of untrusted data if the configuration file was editable. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code.
first Jan 12, 2022 -
Critical max 9.8USN-4495-1 1 CVE
Apache Log4j vulnerability
It was discovered that Apache Log4j does not properly deserialize untrusted data. An attacker could possibly use this issue to remotely execute arbitrary code. (CVE-2019-17571)
first Sep 15, 2020 -
Medium max 6.5USN-4205-1 3 CVEs
sqlite3 vulnerabilities
It was discovered that SQLite incorrectly handled certain schemas. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM. (CVE-2018-8740) It was discovered that SQLite incorrectly handled certain sch…
first Dec 2, 2019 -
Medium max 5.3USN-4083-1 7 CVEs
openjdk-lts vulnerabilities
It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing suppressed exceptions in some situations. An attacker could use this to specially craft an object that, when deserialized, would cause a denial of service. (CVE-2…
first Jul 31, 2019 -
Medium max 5.3USN-4080-1 7 CVEs
openjdk-8 vulnerabilities
Keegan Ryan discovered that the ECC implementation in OpenJDK was not sufficiently resilient to side-channel attacks. An attacker could possibly use this to expose sensitive information. (CVE-2019-2745) It was discovered that OpenJDK did not sufficiently vali…
first Jul 31, 2019 -
Medium max 5.3USN-3997-1 13 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass same-origin protections, or execu…
first May 28, 2019 -
Medium max 5.3USN-3991-1 17 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executa…
first May 21, 2019 -
Medium max 5.3USN-3962-1 1 CVE
libpng1.6 vulnerability
It was discovered that libpng incorrectly handled certain memory operations. If a user or automated system were tricked into opening a specially crafted PNG file, a remote attacker could use this issue to cause libpng to crash, resulting in a denial of servic…
first Apr 30, 2019 -
Critical max 9.8USN-3947-1 1 CVE
libxslt vulnerability
It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this issue to access sensitive information.
first Apr 15, 2019 -
Medium max 6.8USN-3885-1 3 CVEs
openssh vulnerabilities
Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a user or automated system were tricked into connecting to an untrusted server, a remote attacker could possibly use these issues to write to arbitrary files, change directory permission…
first Feb 7, 2019 -
Medium max 5.6USN-3549-1 2 CVEs
linux-kvm vulnerabilities
Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, includ…
first Jan 29, 2018 -
Medium max 5.6USN-3541-2 3 CVEs
linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
USN-3541-1 addressed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. Jann Horn discovered that microprocessors utilizin…
first Jan 23, 2018 -
Medium max 5.6USN-3540-2 3 CVEs
linux-lts-xenial, linux-aws vulnerabilities
USN-3540-1 addressed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jann Horn discovered that microprocessors …
first Jan 23, 2018 -
Medium max 5.6USN-3540-1 3 CVEs
linux, linux-aws, linux-euclid vulnerabilities
Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, includ…
first Jan 23, 2018 -
Medium max 5.6USN-3522-1 1 CVE
linux, linux-aws, linux-euclid, linux-kvm vulnerability
Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive informati…
first Jan 9, 2018 -
Medium max 5.6USN-3521-1 1 CVE
nvidia-graphics-drivers-384 vulnerability
Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, includ…
first Jan 9, 2018 -
Medium max 5.6USN-3530-1 2 CVEs
webkit2gtk vulnerabilities
It was discovered that speculative execution performed by modern CPUs could leak information through a timing side-channel attack, and that this could be exploited in web browser JavaScript engines. If a user were tricked in to opening a specially crafted web…
first Jan 11, 2018 -
Medium max 5.6USN-3524-1 1 CVE
linux vulnerability
Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive informati…
first Jan 9, 2018 -
Medium max 5.6USN-3523-2 4 CVEs
linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
USN-3523-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. Jann Horn discovered that microprocessors utilizing sp…
first Jan 10, 2018 -
Medium max 5.6USN-3522-2 1 CVE
linux-lts-xenial, linux-aws vulnerability
USN-3522-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jann Horn discovered that microprocessors util…
first Jan 9, 2018 -
Medium max 5.6USN-3516-1 3 CVEs
firefox vulnerabilities
It was discovered that speculative execution performed by modern CPUs could leak information through a timing side-channel attack, and that this could be exploited in web browser JavaScript engines. If a user were tricked in to opening a specially crafted web…
first Jan 5, 2018 -
Critical max 9.8
openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2015-2590, CVE-2015-26…
first Jul 30, 2015 -
Low max 3.7USN-2656-1 21 CVEs
firefox vulnerabilities
Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove …
first Jul 9, 2015 -
Low max 3.4USN-2487-1 14 CVEs
openjdk-7 vulnerabilities
Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-3566, CVE-2014-658…
first Jan 28, 2015 -
High max 8.1USN-2710-1 2 CVEs
openssh vulnerabilities
Moritz Jodeit discovered that OpenSSH incorrectly handled usernames when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to perform user impersonation…
first Aug 14, 2015 -
Low max 3.7USN-2673-1 10 CVEs
thunderbird vulnerabilities
Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove …
first Jul 20, 2015 -
UnscoredUSN-8338-2 0 CVEs
apache2 regression
USN-8338-1 fixed vulnerabilities in Apache HTTP Server. The update introduced a regression that prevented mod_http2 from loading on Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discover…
-
Low max 2.1USN-8229-2 1 CVE
sed vulnerability
USN-8229-1 fixed a vulnerability in sed. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: Michał Majchrowicz and Marcin Wyczechowski discovered that sed incorrectly handled symbolic links when…
first May 28, 2026 -
Medium max 5.4USN-8340-1 1 CVE
libreoffice vulnerability
Duc Anh Nguyen discovered that LibreOffice incorrectly handled mismatched encryption salt parameters in crafted OOXML documents. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary co…
first May 28, 2026 -
Medium max 6.6USN-8342-1 1 CVE
vim vulnerability
It was discovered that Vim did not properly handle backticks in tag filenames. An attacker could possibly use this issue to execute arbitrary commands.
first May 28, 2026 -
Critical max 9.8USN-8338-1 15 CVEs
apache2 vulnerabilities
It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-38709) Will Dormann and David Wa…
first May 28, 2026 -
Medium max 6.5USN-8337-1 5 CVEs
qtsvg-opensource-src vulnerabilities
It was discovered that QtSvg incorrectly handled certain SVG images. An attacker could possibly use this issue to cause QtSvg to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-19869) It was discovered that QtSvg …
-
Low max 1.7USN-8335-1 1 CVE
pyopenssl vulnerability
It was discovered that pyOpenSSL incorrectly handled exceptions in the tlsext_servername callback. This could result in connections being accepted after an exception, contrary to expectations.
-
Medium max 6.2USN-8329-1 1 CVE
ffmpeg vulnerability
It was discovered that the FFmpeg CAF decoder incorrectly handled certain file size calculations. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service.
-
Critical max 9.8USN-8316-1 2 CVEs
cableswig vulnerabilities
It was discovered that Expat, vendored in CableSwig, incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
first May 27, 2026 -
High max 7.0USN-8326-1 2 CVEs
foomuuri vulnerabilities
Matthias Gerstner discovered that Foomuuri's D-Bus service did not properly enforce authorization. An unprivileged local attacker could possibly use this issue to manipulate the firewall configuration, contrary to expectations. (CVE-2025-67603) Matthias Gerst…
-
Medium max 5.9USN-8325-1 1 CVE
tgt vulnerability
It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could possibly use this issue to make tgt generate an identical sequence of challenges, resulting in authentication bypass.
-
High max 8.4USN-8324-1 2 CVEs
tika vulnerabilities
It was discovered that Apache Tika incorrectly handled XML external entities when parsing XFA content in PDF files. An attacker could possibly use this issue to obtain sensitive information or send malicious requests to internal resources or third-party serve…
-
High max 7.2USN-8323-1 1 CVE
postorius vulnerability
It was discovered that Postorius did not properly escape HTML in message subjects when rendering the Held messages pop-up. An attacker could possibly use this issue to inject arbitrary HTML, resulting in exposure of sensitive information.
-
High max 8.8USN-8322-1 1 CVE
commons-beanutils vulnerability
It was discovered that Apache Commons BeanUtils incorrectly allowed access to the declaredClass property of Java enum objects when handling externally supplied property paths. An attacker could possibly use this issue to execute arbitrary code.