Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,437 results · Feed

  • High max 7.8
    USN-6555-1 2 CVEs

    xorg-server, xwayland vulnerabilities

    Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled XKB button actions. An attacker could possibly use this issue to cause the X Server to crash, execute arbitrary code, or escalate privileges. (CVE-2023-6377) Jan-Niklas Sohn discovered tha…

    first Dec 13, 2023
  • High max 8.8
    USN-6550-1 3 CVEs

    postfixadmin vulnerabilities

    It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2022-29221) It was …

    first Dec 12, 2023
  • Unscored
    USN-6529-1 4 CVEs

    request-tracker4 vulnerabilities

    It was discovered that Request Tracker incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. (CVE-2021-38…

    first Dec 4, 2023
  • Medium max 5.3
    USN-6527-1 2 CVEs

    openjdk-17, openjdk-21, openjdk-lts vulnerabilities

    Carter Kozak discovered that OpenJDK, when compiling with AVX-512 instruction support enabled, could produce code that resulted in memory corruption in certain situations. An attacker targeting applications built in this way could possibly use this to cause a…

    first Nov 29, 2023
  • High max 7.5
    USN-6507-1 1 CVE

    glusterfs vulnerability

    It was discovered that GlusterFS incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause GlusterFS to crash, resulting in a denial of service.

    first Nov 22, 2023
  • Critical max 9.8
    USN-6525-1 1 CVE

    pysha3 vulnerability

    Nicky Mouha discovered that pysha incorrectly handled certain SHA-3 operations. An attacker could possibly use this issue to cause pysha3 to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Nov 29, 2023
  • High max 8.8
    USN-6538-1 3 CVEs

    postgresql-12, postgresql-14, postgresql-15 vulnerabilities

    Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown arguments in aggregate function calls. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-5868) Pedro Gallegos discovered that PostgreSQL incorr…

    first Dec 6, 2023
  • High max 7.7
    USN-6523-1 3 CVEs

    u-boot-nezha vulnerability

    It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-2347) Nicolas Bidron and …

    first Nov 29, 2023
  • Unscored
    USN-6513-2 1 CVE

    python3.8, python3.10, python3.11 vulnerability

    USN-6513-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. Original advisory details: It was discovered that Python incorrectly handled certain plist files. If a user or…

    first Nov 27, 2023
  • Critical max 9.8
    USN-6524-1 1 CVE

    pypy3 vulnerability

    Nicky Mouha discovered that PyPy incorrectly handled certain SHA-3 operations. An attacker could possibly use this issue to cause PyPy to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Nov 29, 2023
  • Unscored
    USN-6511-1 1 CVE

    zfs-linux vulnerability

    It was discovered that the OpenZFS sharenfs feature incorrectly handled IPv6 address data. This could result in IPv6 restrictions not being applied, contrary to expectations.

    first Nov 23, 2023
  • Unscored
    USN-6467-2 1 CVE

    krb5 vulnerability

    USN-6467-1 fixed a vulnerability in Kerberos. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. Original advisory details: Robert Morris discovered that Kerberos did not properly handle memory access when p…

    first Nov 6, 2023
  • High max 7.1
    USN-6514-1 1 CVE

    openvswitch vulnerability

    It was discovered that Open vSwitch did not correctly handle OpenFlow rules for ICMPv6 Neighbour Advertisement packets. A local attacker could possibly use this issue to redirect traffic to arbitrary IP addresses.

    first Nov 26, 2023
  • High max 7.5
    USN-6505-1 1 CVE 1 exploited

    nghttp2 vulnerability

    It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service.

    first Nov 22, 2023
  • Medium max 4.9
    USN-6501-1 1 CVE

    rabbitmq-server vulnerability

    It was discovered that RabbitMQ incorrectly handled certain HTTP requests. An attacker could possibly use this issue to cause a denial of service.

    first Nov 21, 2023
  • Medium max 5.5
    USN-6486-1 1 CVE

    iniparser vulnerability

    It was discovered that iniParser incorrectly handled certain files. An attacker could possibly use this issue to cause a crash.

    first Nov 20, 2023
  • Unscored
    USN-6482-1 2 CVEs

    quagga vulnerabilities

    It was discovered that Quagga incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service.

    first Nov 15, 2023
  • Critical max 9.8
    USN-6483-1 1 CVE

    tidy-html5 vulnerability

    Neeraj Pal discovered that HTML Tidy incorrectly handled parsing certain HTML data. If a user or automated system were tricked into parsing specially crafted HTML data, a remote attacker could cause HTML Tidy to consume resources, leading to a denial of servi…

    first Nov 15, 2023
  • Unscored
    USN-6458-1 3 CVEs

    slurm-llnl, slurm-wlm vulnerabilities

    It was discovered that Slurm did not properly handle credential management, which could allow an unprivileged user to impersonate the SlurmUser account. An attacker could possibly use this issue to execute arbitrary code as the root user. (CVE-2022-29500) It …

    first Oct 30, 2023
  • Medium max 5.3
    USN-6435-2 2 CVEs

    openssl vulnerabilities

    USN-6435-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenSSL incorrectly handled excessively large Diffie-Hellman parameters. An attacker could poss…

    first Oct 25, 2023
  • Medium max 6.5
    USN-6459-1 14 CVEs

    mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.35 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. In addition to security fixes, …

    first Oct 30, 2023
  • Unscored
    USN-6434-1 1 CVE

    pmix vulnerability

    Francois Diakhate discovered that PMIx did not properly handle race conditions in the pmix library, which could lead to unwanted privilege escalation. An attacker could possibly use this issue to obtain ownership of an arbitrary file on the filesystem, under …

    first Oct 17, 2023
  • High max 8.8
    USN-6526-1 6 CVEs

    gst-plugins-bad1.0 vulnerabilities

    It was discovered that GStreamer Bad Plugins incorrectly handled certain media files. A remote attacker could use this issue to cause GStreamer Bad Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Nov 29, 2023
  • High max 7.5
    USN-6427-1 1 CVE 1 exploited

    dotnet6, dotnet7 vulnerability

    It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service.

    first Oct 10, 2023
  • Unscored
    USN-6431-2 1 CVE

    iperf3 vulnerability

    USN-6431-1 fixed a vulnerability in iperf3. This update provides the corresponding update for Ubuntu 22.04 LTS and Ubuntu 23.04. Original advisory details: It was discovered that iperf3 did not properly manage certain inputs, which could lead to a crash. A re…

    first Oct 16, 2023
  • Medium max 5.9
    USN-6414-1 1 CVE

    python-django vulnerability

    Wenchao Li discovered that the Django Truncator function incorrectly handled very long HTML input. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.

    first Oct 4, 2023
  • High max 7.5
    USN-6410-1 2 CVEs

    grub2-signed, grub2-unsigned vulnerabilities

    It was discovered that a specially crafted file system image could cause a heap-based out-of-bounds write. A local attacker could potentially use this to perform arbitrary code execution bypass and bypass secure boot protections. (CVE-2023-4692) It was discov…

    first Oct 4, 2023
  • Medium max 5.9
    USN-6414-2 2 CVEs

    python-django vulnerabilities

    USN-6414-1 and USN-6378-1 fixed CVE-2023-43665 and CVE-2023-41164 in Django, respectively. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Wenchao Li discovered that the Django Truncator function incorrectly hand…

    first Oct 4, 2023
  • High max 7.8
    USN-6408-1 4 CVEs

    libxpm vulnerabilities

    Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were tricked into opening a specially crafted XPM image file, a remote attacker could possibly use this issue to consume memory, leading to a denial of servic…

    first Oct 3, 2023
  • High max 7.0
    USN-6391-1 1 CVE

    cups vulnerability

    It was discovered that CUPS incorrectly parsed certain Postscript objects. If a user or automated system were tricked into printing a specially crafted document, a remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, …

    first Sep 20, 2023
  • Unscored
    USN-6379-1 1 CVE

    vsftpd vulnerability

    It was discovered that vsftpd was vulnerable to the ALPACA TLS protocol content confusion attack. A remote attacker could possibly use this issue to redirect traffic from one subdomain to another.

    first Sep 18, 2023
  • Unscored
    USN-6377-1 1 CVE

    libraw vulnerability

    It was discovered that LibRaw incorrectly handled certain photo files. If a user o automated system were tricked into processing a specially crafted photo file, a remote attacker could possibly cause applications linked against LibRaw to crash, resulting in a…

    first Sep 18, 2023
  • Unscored
    USN-6376-1 1 CVE

    c-ares vulnerability

    It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-res to crash, resulting in a denial of service.

    first Sep 18, 2023
  • Medium max 5.3
    USN-6378-1 1 CVE

    python-django vulnerability

    It was discovered that Django incorrectly handled certain URIs with a very large number of Unicode characters. A remote attacker could possibly use this issue to cause Django to consume resources or crash, leading to a denial of service.

    first Sep 18, 2023
  • Unscored
    USN-6389-1 1 CVE

    indent vulnerability

    It was discovered that Indent incorrectly handled parsing certain source files. If a user or automated system were tricked into processing a specially crafted source file, a remote attacker could use this issue to cause Indent to crash, resulting in a denial …

    first Sep 20, 2023
  • High max 7.8
    USN-6453-1 2 CVEs

    xorg-server, xwayland vulnerabilities

    Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled prepending values to certain properties. An attacker could possibly use this issue to cause the X Server to crash, execute arbitrary code, or escalate privileges. (CVE-2023-5367) Sri disco…

    first Oct 25, 2023
  • High max 7.5
    USN-6450-1 4 CVEs

    openssl vulnerabilities

    Tony Battersby discovered that OpenSSL incorrectly handled key and initialization vector (IV) lengths. This could lead to truncation issues and result in loss of confidentiality for some symmetric cipher modes. (CVE-2023-5363) Juerg Wullschleger discovered th…

    first Oct 24, 2023
  • High max 8.8
    USN-6423-1 1 CVE

    libcue vulnerability

    It was discovered that CUE incorrectly handled certain files. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code.

    first Oct 9, 2023
  • Critical max 9.4
    USN-6305-1 2 CVEs

    php8.1 vulnerabilities

    It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2023-3823) It was discovered that PHP incorrectly handled certain PHAR files. An attacker could possibly use this…

    first Aug 23, 2023
  • High max 8.6
    USN-6307-1 1 CVE

    cjose vulnerability

    It was discovered that JOSE for C/C++ AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. An attacker could use this to cause a denial of service (system crash) or might expose sensitive informati…

    first Aug 24, 2023