Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,437 results · Feed

  • Unscored
    USN-5472-1 34 CVEs

    ffmpeg vulnerabilities

    It was discovered that FFmpeg would attempt to divide by zero when using Linear Predictive Coding (LPC) or AAC codecs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubun…

    first Jun 8, 2022
  • Unscored
    USN-5399-1 6 CVEs

    libvirt vulnerabilities

    It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-202…

    first May 2, 2022
  • High max 7.8
    USN-5483-1 22 CVEs

    exempi vulnerabilities

    It was discovered that Exempi incorrectly handled certain media files. If a user or automated system were tricked into opening a specially crafted file, a remote attacker could cause Exempi to stop responding or crash, resulting in a denial of service, or pos…

    first Jun 16, 2022
  • Critical max 9.8
    USN-5402-1 4 CVEs

    openssl, openssl1.0 vulnerabilities

    Elison Niven discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. (CVE-2022-1292) Raul Metsma discovered that OpenSSL incorrectly verified certain r…

    first May 4, 2022
  • High max 8.1
    USN-5387-1 2 CVEs

    barbican vulnerabilities

    Douglas Mendizábal discovered that Barbican incorrectly handled access restrictions. An authenticated attacker could possibly use this issue to consume protected resources and possibly cause a denial of service. (CVE-2022-23451, CVE-2022-23452)

    first Apr 25, 2022
  • High max 7.0
    USN-5305-1 10 CVEs

    mariadb-10.3, mariadb-10.5 vulnerabilities

    Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.34 in Ubuntu 20.04 LTS and to 10.5.15 in Ubuntu 21.10. In addition to security fixes, the updated p…

    first Feb 28, 2022
  • Unscored
    USN-5608-1 1 CVE

    dpdk vulnerability

    It was discovered that DPDK incorrectly handled certain Vhost headers. A remote attacker could possibly use this issue to cause a denial of service.

    first Sep 13, 2022
  • High max 8.1
    USN-5576-1 1 CVE

    twisted vulnerability

    It was discovered that Twisted incorrectly parsed some types of HTTP requests in its web server implementation. In certain proxy or multi-server configurations, a remote attacker could craft malicious HTTP requests in order to obtain sensitive information.

    first Aug 24, 2022
  • Unscored
    USN-5561-1 4 CVEs

    epiphany-browser vulnerabilities

    It was discovered that GNOME Web incorrectly filtered certain strings. A remote attacker could use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-45085, CVE-2021-45086, CVE-2021-45087) It was dis…

    first Aug 10, 2022
  • Unscored
    USN-5571-1 1 CVE

    postgresql-10, postgresql-12, postgresql-14 vulnerability

    Sven Klemm discovered that PostgreSQL incorrectly handled extensions. An attacker could possibly use this issue to execute arbitrary code when extensions are created or updated.

    first Aug 18, 2022
  • Unscored
    USN-5563-1 1 CVE

    http-parser vulnerability

    It was discovered that http-parser incorrectly handled certain requests. An attacker could possibly use this issue to bypass security controls or gain unauthorized access to sensitive data.

    first Aug 10, 2022
  • Medium max 4.3
    USN-5542-1 6 CVEs

    samba vulnerabilities

    It was discovered that Samba did not handle MaxQueryDuration when being used in AD DC configurations, contrary to expectations. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3670) Luke Howard discovered that Samba incorrectly handled certain restrictio…

    first Aug 1, 2022
  • High max 7.5
    USN-5559-1 2 CVEs

    node-moment vulnerabilities

    It was discovered that Moment.js incorrectly handled certain input paths. An attacker could possibly use this issue to cause a loss of integrity by changing the correct path to one of their choice. (CVE-2022-24785) It was discovered that Moment.js incorrectly…

    first Aug 10, 2022
  • High max 7.5
    USN-5538-1 1 CVE

    libtirpc vulnerability

    It was discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.

    first Jul 28, 2022
  • Unscored
    USN-5510-1 2 CVEs

    xorg-server, xorg-server-hwe-18.04, xwayland vulnerabilities

    Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain inputs. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code and escalate privileges.

    first Jul 12, 2022
  • High max 8.8
    USN-5509-1 1 CVE

    dovecot vulnerability

    Julian Brook discovered that Dovecot incorrectly handled multiple passdb configuration entries. In certain configurations, a remote attacker could possibly use this issue to escalate privileges.

    first Jul 11, 2022
  • High max 7.5
    USN-5502-1 1 CVE

    openssl vulnerability

    Alex Chernyakhovsky discovered that OpenSSL incorrectly handled AES OCB mode when using the AES-NI assembly optimized implementation on 32-bit x86 platforms. A remote attacker could possibly use this issue to obtain sensitive information.

    first Jul 5, 2022
  • Unscored
    USN-5491-1 1 CVE

    squid, squid3 vulnerability

    Joshua Rogers discovered that Squid incorrectly handled the Gopher protocol. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service.

    first Jun 22, 2022
  • Unscored
    USN-5482-1 7 CVEs

    spip vulnerabilities

    It was discovered that SPIP incorrectly validated inputs. An authenticated attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28984) Charles Fol and Théo Gordyjan discovered that SPIP is vuln…

    first Jun 16, 2022
  • High max 8.1
    USN-5479-3 1 CVE

    php7.2 regression

    USN-5479-1 fixed vulnerabilities in PHP. Unfortunately that update for CVE-2022-31625 was incomplete for Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Charles Fol discovered that PHP incorrectl…

    first Jul 7, 2022
  • Critical max 9.8
    USN-5488-1 1 CVE

    openssl, openssl1.0 vulnerability

    Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run.

    first Jun 21, 2022
  • High max 7.8
    USN-5141-1 1 CVE

    firejail vulnerability

    Roman Fiedler discovered that a race condition existed in Firejail when using OverlayFS to prevent writes to the underlying file system. A local attacker could use this to gain administrative privileges. Note: this update disables support for OverlayFS in Fir…

    first Nov 11, 2021
  • Unscored
    USN-5482-2 4 CVEs

    spip vulnerabilities

    USN-5482-1 fixed several vulnerabilities in SPIP. This update provides the corresponding updates for Ubuntu 20.04 LTS for CVE-2021-44118, CVE-2021-44120, CVE-2021-44122 and CVE-2021-44123. Original advisory details: It was discovered that SPIP incorrectly val…

    first Mar 2, 2023
  • High max 8.1
    USN-5479-1 2 CVEs

    php7.2, php7.4, php8.0, php8.1 vulnerabilities

    Charles Fol discovered that PHP incorrectly handled initializing certain arrays when handling the pg_query_params function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CV…

    first Jun 15, 2022
  • Unscored
    USN-5569-1 2 CVEs

    unbound vulnerabilities

    Xiang Li discovered that Unbound incorrectly handled delegation caching. A remote attacker could use this issue to keep rogue domain names resolvable long after they have been revoked.

    first Aug 16, 2022
  • Critical max 9.1
    USN-5461-1 2 CVEs

    freerdp2 vulnerabilities

    It was discovered that FreeRDP incorrectly handled empty password values. A remote attacker could use this issue to bypass server authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-24882) It was discovered…

    first Jun 6, 2022
  • Unscored
    USN-5446-1 1 CVE

    dpkg vulnerability

    Max Justicz discovered that dpkg incorrectly handled unpacking certain source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, …

    first May 26, 2022
  • Medium max 6.5
    USN-5400-1 23 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.29 in Ubuntu 20.04 LTS, Ubuntu 21.10, and Ubuntu 22.04 LTS. Ubuntu 18.04 LTS has been updated to MySQL 5.…

    first May 3, 2022
  • High max 7.5
    USN-5388-1 5 CVEs

    openjdk-lts vulnerabilities

    It was discovered that OpenJDK incorrectly limited memory when compiling a specially crafted XPath expression. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-21426) It was discovered that OpenJDK incorrectly handled converti…

    first Apr 26, 2022
  • High max 7.8
    USN-5367-1 1 CVE

    fish vulnerability

    Justin Steven discovered that fish was not properly filtering local git configuration directives when running background git commands. A remote unauthenticated attacker could possibly use this issue to execute arbitrary code.

    first Aug 10, 2022
  • Medium max 5.9
    USN-5351-1 1 CVE

    paramiko vulnerability

    Jan Schejbal discovered that Paramiko incorrectly handled permissions when writing private key files. A local attacker could possibly use this issue to gain access to private keys.

    first Mar 28, 2022
  • Unscored
    USN-5323-1 2 CVEs

    nbd vulnerabilities

    It was discovered that NBD incorrectly handled name length fields. A remote attacker could use this issue to cause NBD to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Mar 14, 2022
  • Medium max 5.3
    USN-5313-1 15 CVEs

    openjdk-lts, openjdk-17 vulnerabilities

    It was discovered that OpenJDK incorrectly handled deserialization filters. An attacker could possibly use this issue to insert, delete or obtain sensitive information. (CVE-2022-21248) It was discovered that OpenJDK incorrectly read uncompressed TIFF files. …

    first Mar 7, 2022
  • High max 7.8
    USN-5427-1 8 CVEs

    apport vulnerabilities

    Muqing Liu and neoni discovered that Apport incorrectly handled detecting if an executable was replaced after a crash. A local attacker could possibly use this issue to execute arbitrary code as the root user. (CVE-2021-3899) Gerrit Venema discovered that App…

    first May 17, 2022
  • Unscored
    USN-5309-1 2 CVEs

    virglrenderer vulnerabilities

    It was discovered that virglrenderer incorrectly handled memory. An attacker inside a guest could use this issue to cause virglrenderer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-0135) It was discovered that virg…

    first Feb 28, 2022
  • Medium max 5.4
    USN-5067-1 4 CVEs

    sssd vulnerabilities

    Jakub Hrozek discovered that SSSD incorrectly handled file permissions. A local attacker could possibly use this issue to read the sudo rules available for any user. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10852) It was discovered that SSSD incor…

    first Sep 8, 2021
  • Unscored
    USN-4837-1 13 CVEs

    libsass vulnerabilities

    It was discovered that LibSass incorrectly handled certain specially crafted sass file. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

    first Mar 15, 2021
  • Unscored
    USN-4632-1 2 CVEs

    slirp vulnerabilities

    It was discovered that the SLiRP networking implementation of the QEMU emulator did not properly manage memory under certain circumstances. An attacker could use this to cause a heap-based buffer overflow or other out- of-bounds access, which can lead to a de…

    first Nov 12, 2020
  • Medium max 6.5
    USN-5155-1 3 CVEs

    bluez vulnerabilities

    It was discovered that BlueZ incorrectly handled the Discoverable status when a device is powered down. This could result in devices being powered up discoverable, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 2…

    first Nov 23, 2021
  • High max 7.5
    USN-5088-1 4 CVEs

    edk2 vulnerabilities

    It was discovered that EDK II incorrectly handled input validation in MdeModulePkg. A local user could possibly use this issue to cause EDK II to crash, resulting in a denial of service, obtain sensitive information or execute arbitrary code. (CVE-2019-11098)…

    first Sep 23, 2021