8,437 results · Feed
-
UnscoredUSN-5371-2 1 CVE
nginx vulnerability
USN-5371-1 fixed several vulnerabilities in nginx. This update provides the fix for CVE-2021-3618 for Ubuntu 22.04 LTS. Original advisory details: It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to …
first Apr 28, 2022 -
Medium max 5.3USN-5300-2 5 CVEs
php7.2, php7.4 vulnerabilities
USN-5300-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this i…
first Mar 3, 2022 -
Critical max 9.8USN-5051-1 2 CVEs
openssl vulnerabilities
John Ouyang discovered that OpenSSL incorrectly handled decrypting SM2 data. A remote attacker could use this issue to cause applications using OpenSSL to crash, resulting in a denial of service, or possibly change application behaviour. (CVE-2021-3711) Ingo …
first Aug 24, 2021 -
UnscoredUSN-5524-1 1 CVE
harfbuzz vulnerability
It was discovered that HarfBuzz incorrectly handled certain glyph sizes. A remote attacker could use this issue to cause HarfBuzz to crash, resulting in a denial of service.
first Jul 19, 2022 -
High max 7.5USN-5525-1 1 CVE
libxml-security-java vulnerability
It was discovered that Apache XML Security for Java incorrectly passed a configuration property when creating specific key elements. This allows an attacker to abuse an XPath Transform to extract sensitive information.
first Jul 20, 2022 -
Medium max 5.5USN-5170-1 1 CVE
mariadb-10.3, mariadb-10.5 vulnerability
A security issue was discovered in MariaDB and this update includes new upstream MariaDB versions to fix the issue. MariaDB has been updated to 10.3.32 in Ubuntu 20.04 LTS and to 10.5.13 in Ubuntu 21.04 and Ubuntu 21.10. In addition to security fixes, the upd…
first Dec 6, 2021 -
UnscoredUSN-5440-1 1 CVE
postgresql-10, postgresql-12, postgresql-13, postgresql-14 vulnerability
Alexander Lakhin discovered that PostgreSQL incorrectly handled the security restricted operation sandbox when a privileged user is maintaining another user's objects. An attacker having permission to create non-temp objects can use this issue to execute arbi…
first May 24, 2022 -
Medium max 6.7USN-8173-1 2 CVEs
policykit-1 vulnerabilities
It was discovered that polkit incorrectly handled nested elements in XML policy files. If an administrator were tricked into installing a malicious policy file, a remote attacker could possibly use this issue to cause polkit to crash, resulting in a denial of…
first Apr 14, 2026 -
Critical max 9.3USN-8190-1 1 CVE
ruby-rack-session vulnerability
SeungMyung Lee discovered that Rack::Session did not properly reject cookies upon decryption failure. A remote attacker could use this issue to manipulate session contents and possibly gain unauthorized access.
first Apr 20, 2026 -
Medium max 6.8USN-8167-1 1 CVE
xdg-dbus-proxy vulnerability
It was discovered that xdg-dbus-proxy incorrectly handled eavesdropping in policy rules. A local attacker could possibly use this issue to intercept certain D-Bus messages.
first Apr 13, 2026 -
Medium max 5.1USN-8168-1 1 CVE
rustc vulnerability
It was discovered that tar-rs embedded in rustc incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissions…
first Apr 13, 2026 -
High max 8.2USN-8170-1 2 CVEs
corosync vulnerabilities
It was discovered that Corosync incorrectly handled the membership commit token validity check. A remote attacker could use this issue to cause Corosync to crash, resulting in a denial of service, or to possibly obtain a small quantity of sensitive informatio…
first Apr 13, 2026 -
Critical max 9.8USN-8128-1 3 CVEs
libcryptx-perl vulnerabilities
It was discovered that CryptX did not verify authentication tags while performing GCM and ChaCha20-Poly1305 decryption. An attacker could possibly use this issue to cause CryptX to accept modified ciphertext, leading to data integrity violations or authentica…
first Mar 26, 2026 -
High max 7.5USN-8073-1 5 CVEs
qemu vulnerabilities
It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-8354) It was discovered th…
first Mar 4, 2026 -
High max 7.1USN-7963-1 3 CVEs
libpng1.6 vulnerabilities
It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma correction. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to…
first Jan 14, 2026 -
High max 7.5USN-7970-1 5 CVEs
iperf3 vulnerabilities
Jorge Sancho Larraz discovered that iperf3 did not properly manage certain inputs, which could cause the server process to stop responding, waiting for input on the control connection. A remote attacker could possibly use this issue to cause a denial of servi…
first Jan 21, 2026 -
UnscoredUSN-4988-1 34 CVEs
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …
first Jun 15, 2021 -
UnscoredUSN-4458-1 5 CVEs
apache2 vulnerabilities
Fabrice Perez discovered that the Apache mod_rewrite module incorrectly handled certain redirects. A remote attacker could possibly use this issue to perform redirects to an unexpected URL. (CVE-2020-1927) Chamal De Silva discovered that the Apache mod_proxy_…
first Aug 13, 2020 -
High max 7.5USN-8084-1 5 CVEs
curl vulnerabilities
Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different connection, contrary to expectations. (CVE-2026-1965) It was disco…
first Mar 11, 2026 -
High max 7.5USN-8062-1 9 CVEs
curl vulnerabilities
It was discovered that curl incorrectly handled cookies when redirected from secure to insecure connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2…
first Feb 25, 2026 -
High max 7.5USN-8156-1 1 CVE
gdk-pixbuf vulnerability
It was discovered that GDK-PixBuf incorrectly handled certain JPEG files. An attacker could use this issue to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Apr 8, 2026 -
High max 8.4USN-8166-1 1 CVE
retroarch vulnerability
It was discovered that RetroArch did not correctly handle certain memory operations, which could lead to a buffer overflow. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a …
first Apr 12, 2026 -
High max 8.1USN-5404-1 1 CVE
rsyslog vulnerability
Pieter Agten discovered that Rsyslog incorrectly handled certain requests. An attacker could possibly use this issue to cause a crash.
first May 5, 2022 -
Medium max 5.4USN-8151-1 1 CVE
lambdaisland-uri-clojure vulnerability
It was discovered that lambdaisland/uri did not properly sanitize the backslash character in URI strings. An attacker could possibly use this issue to bypass security checks or redirect users.
first Apr 6, 2026 -
Medium max 5.1USN-4400-1 1 CVE
nfs-utils vulnerability
It was discovered that the nfs-utils package set incorrect permissions on the /var/lib/nfs directory. An attacker could possibly use this issue to escalate privileges.
first Jun 22, 2020 -
Medium max 5.1USN-8138-2 1 CVE
rust-tar vulnerability
USN-8138-1 fixed a vulnerability in tar-rs. This update provides the corresponding update for Ubuntu 20.04 LTS. Original advisory details: It was discovered that tar-rs incorrectly handled symlinks when unpacking a tar archive. If a user or automated system w…
first Apr 14, 2026 -
High max 7.5USN-8117-1 1 CVE
strongswan vulnerability
Kazuma Matsumoto discovered that strongSwan incorrectly handled EAP-TTLS AVPs when using the eap-ttls plugin. An attacker could possibly use this issue to cause strongSwan to consume resources and crash, resulting in a denial of service.
first Mar 23, 2026 -
High max 8.0USN-4604-1 48 CVEs
mysql-5.7, mysql-8.0 vulnerabilities
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.22 in Ubuntu 20.04 LTS and Ubuntu 20.10. Ubuntu 16.04 LTS and Ubuntu 18.04 LTS have been updated to MySQL…
first Oct 27, 2020 -
Medium max 5.1USN-8138-1 1 CVE
rust-tar vulnerability
It was discovered that tar-rs incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissions of arbitrary dire…
first Apr 1, 2026 -
UnscoredUSN-4972-1 3 CVEs
postgresql-10, postgresql-12, postgresql-13 vulnerabilities
Tom Lane discovered that PostgreSQL incorrect handled certain array subscripting calculations. An authenticated attacker could possibly use this issue to overwrite server memory and escalate privileges. (CVE-2021-32027) Andres Freund discovered that PostgreSQ…
first Jun 1, 2021 -
High max 7.0USN-8120-1 1 CVE
redis vulnerability
Seunghyun Lee discovered that Redis incorrectly handled memory during hyperloglog operations. An attacker could use this issue to cause a denial of service, or possibly achieve remote code execution.
first Mar 24, 2026 -
Medium max 4.3USN-8114-1 2 CVEs
gvfs vulnerabilities
It was discovered that the GVfs FTP backend incorrectly handled IP addresses and ports returned by passive mode responses. A malicious remote server could possibly use this issue to help scan for open ports. (CVE-2026-28295) It was discovered that the GVfs FT…
first Mar 23, 2026 -
Medium max 5.1USN-8139-1 1 CVE
rust-cargo-c vulnerability
It was discovered that tar-rs embedded in cargo-c incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissio…
first Apr 1, 2026 -
High max 8.9USN-8123-1 7 CVEs
mbedtls vulnerabilities
It was discovered that Mbed TLS incorrectly handled memory allocation failures. A remote attacker could possibly use this issue to crash the program. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-44732) Jonathan Winzig discovered t…
first Mar 25, 2026 -
UnscoredUSN-4974-1 1 CVE
lasso vulnerability
It was discovered that Lasso did not properly verify that all assertions in a SAML response were properly signed. An attacker could possibly use this to impersonate users or otherwise bypass access controls.
first Jun 2, 2021 -
Low max 1.8USN-8103-2 1 CVE
exiv2 regression
USN-8103-1 fixed vulnerabilities in Exiv2. The update caused a regression for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovere…
first Mar 19, 2026 -
Medium max 6.5USN-8099-1 3 CVEs
curl vulnerabilities
Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different connection, contrary to expectations. This issue only affected Ubu…
first Mar 16, 2026 -
High max 7.2
roundcube vulnerabilities
It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack.
first Mar 16, 2026 -
UnscoredUSN-4598-1 1 CVE
libetpan vulnerability
It was discovered that LibEtPan incorrectly handled STARTTLS when using IMAP, SMTP and POP3. A remote attacker could possibly use this issue to perform a response injection attack. (CVE-2020-15953)
first Oct 22, 2020 -
UnscoredUSN-4986-1 1 CVE
rpcbind vulnerability
It was discovered that rpcbind incorrectly handled certain large data sizes. A remote attacker could use this issue to cause rpcbind to consume resources, leading to a denial of service.
first Jun 9, 2021