Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,437 results · Feed

  • Medium max 6.1
    USN-5013-1 2 CVEs

    systemd vulnerabilities

    It was discovered that systemd incorrectly handled certain mount paths. A local attacker could possibly use this issue to cause systemd to crash, resulting in a denial of service. (CVE-2021-33910) Mitchell Frank discovered that systemd incorrectly handled DHC…

    first Jul 20, 2021
  • Unscored
    USN-5009-1 6 CVEs

    libslirp vulnerabilities

    Qiuhao Li discovered that libslirp incorrectly handled certain header data lengths. An attacker inside a guest could possibly use this issue to leak sensitive information from the host. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-291…

    first Jul 15, 2021
  • Unscored
    USN-4971-1 11 CVEs

    libwebp vulnerabilities

    It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause libwebp to crash, resulting in a denial of ser…

    first Jun 1, 2021
  • Unscored
    USN-4938-1 13 CVEs

    unbound vulnerabilities

    It was discovered that Unbound contained multiple security issues. A remote attacker could possibly use these issues to cause a denial of service, inject arbitrary commands, execute arbitrary code, and overwrite local files.

    first May 6, 2021
  • Critical max 9.8
    USN-5107-1 7 CVEs

    firefox vulnerabilities

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof another origin, or execute arbitrary code.

    first Oct 7, 2021
  • Medium max 5.9
    USN-5038-1 2 CVEs

    postgresql-10, postgresql-12, postgresql-13 vulnerabilities

    It was discovered that the PostgresQL planner could create incorrect plans in certain circumstances. A remote attacker could use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly obtain sensitive information from memory. T…

    first Aug 12, 2021
  • High max 8.0
    USN-4943-1 14 CVEs

    libxstream-java vulnerabilities

    Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. This issue affected only affected Ubuntu 20.10. (CVE-2020-26217) It was discov…

    first May 11, 2021
  • Unscored
    USN-4702-1 2 CVEs

    pound vulnerabilities

    It was discovered that Pound incorrectly handled certain HTTP requests A remote attacker could use it to retrieve some sensitive information. (CVE-2016-10711, CVE-2018-21245)

    first Jan 25, 2021
  • Unscored
    USN-4650-1 8 CVEs

    qemu vulnerabilities

    Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default insta…

    first Nov 30, 2020
  • Medium max 6.5
    USN-5181-1 2 CVEs

    jqueryui vulnerability

    It was discovered that jQuery UI did not properly validate the values from untrusted sources. An attacker could use this vulnerability to cause a crash or possibly execute arbitrary code. This issue affected only Ubuntu 18.04 ESM and Ubuntu 20.4 ESM. (CVE-202…

    first Sep 9, 2022
  • Unscored
    USN-5010-1 20 CVEs

    qemu vulnerabilities

    Lei Sun discovered that QEMU incorrectly handled certain MMIO operations. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-15469) Wenxiang Qian discovered that QEMU incorrectly hand…

    first Jul 15, 2021
  • High max 7.5
    USN-4882-1 3 CVEs

    ruby2.3, ruby2.5, ruby2.7 vulnerabilities

    It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated system were tricked into parsing a specially crafted JSON file, a remote attacker could use this issue to execute arbitrary code. This issue only affected …

    first Mar 18, 2021
  • Unscored
    USN-4734-2 2 CVEs

    wpa vulnerabilities

    USN-4734-1 fixed several vulnerabilities in wpa_supplicant. This update provides the corresponding update for Ubuntu 14.04 ESM. It was discovered that wpa_supplicant did not properly handle P2P (Wi-Fi Direct) group information in some situations, leading to a…

    first Feb 16, 2021
  • High max 7.8
    USN-4705-1 2 CVEs 1 exploited

    sudo vulnerabilities

    It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156) It was discovered that the Sudo sudoedit utility incorr…

    first Jan 26, 2021
  • High max 7.5
    USN-4691-1 2 CVEs

    openvswitch vulnerabilities

    Jonas Rudloff discovered that Open vSwitch incorrectly handled certain malformed LLDP packets. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jan 13, 2021
  • Unscored
    USN-4686-1 9 CVEs

    ghostscript vulnerabilities

    It was discovered that Ghostscript incorrectly handled certain image files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could use this issue to cause Ghostscript to crash, resulting in a denial of ser…

    first Jan 7, 2021
  • High max 7.1
    USN-5270-1 26 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.28 in Ubuntu 20.04 LTS and Ubuntu 21.10. Ubuntu 18.04 LTS has been updated to MySQL 5.7.37. In addition t…

    first Feb 3, 2022
  • Unscored
    USN-5259-2 4 CVEs

    cron vulnerabilities

    USN-5259-1 fixed several vulnerabilities in Cron. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: It was discovered that the postinst maintainer script in Cron unsafely handled file permissions during package ins…

    first May 6, 2022
  • High max 8.2
    USN-5283-1 1 CVE

    node-tar vulnerability

    It was discovered that Tar for Node.js did not properly sanitize path inputs. An attacker could possibly use this issue to read arbitrary files, resulting in a directory traversal attack.

    first Feb 11, 2022
  • Unscored
    USN-5198-1 1 CVE

    htmldoc vulnerability

    It was discovered that HTMLDOC improperly handled malformed URIs from an input html file. An attacker could use this to cause a denial of service.

    first Dec 16, 2021
  • Critical max 9.8
    USN-5227-3 1 CVE

    pillow vulnerability

    USN-5227-1 fixed vulnerabilities in Pillow. It was discovered that the fix for CVE-2022-22817 was incomplete. This update fixes the problem. Original advisory details: It was discovered that Pillow incorrectly handled certain image files. If a user or automat…

    first Oct 24, 2022
  • High max 7.5
    USN-5204-1 3 CVEs

    python-django vulnerabilities

    Chris Bailey discovered that Django incorrectly handled evaluating submitted passwords. A remote attacker could possibly use this issue to consume resources, resulting in a denial of service. (CVE-2021-45115) Dennis Brinkrolf discovered that Django incorrectl…

    first Jan 5, 2022
  • Unscored
    USN-5174-1 4 CVEs

    samba vulnerabilities

    Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote attacker could possibly use this issue to downgrade connections to plaintext authentication. (CVE-2016-2124) Andrew Bartlett discovered that Samba incorrectly mappin…

    first Dec 6, 2021
  • Unscored
    USN-5331-2 2 CVEs

    tcpdump vulnerabilities

    USN-5331-1 fixed several vulnerabilities in tcpdump. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that tcpdump incorrectly handled certain inputs. An attacker could possi…

    first Apr 11, 2022
  • Medium max 5.8
    USN-5154-1 2 CVEs

    freerdp2 vulnerabilities

    It was discovered that FreeRDP incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2021-41159) It was discovered that FreeRDP incorrectly handled certain connections. An attacker could…

    first Nov 23, 2021
  • Unscored
    USN-5145-1 2 CVEs

    postgresql-10, postgresql-12, postgresql-13 vulnerabilities

    Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption. A remote attacker could possibly use this issue to inject arbitrary SQL queries when a connection is first established.

    first Nov 11, 2021
  • Unscored
    USN-5148-1 1 CVE

    hivex vulnerability

    It was discovered that hivex incorrectly handled certain input. An attacker could use this vulnerability to cause a crash or obtain sensitive information.

    first Nov 16, 2021
  • High max 7.1
    USN-5123-1 43 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.27 in Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. Ubuntu 18.04 LTS has been updated to MySQL 5.7.36…

    first Oct 25, 2021
  • Medium max 6.5
    USN-5098-1 1 CVE

    node-bl vulnerability

    It was discovered that bl didn't properly sanitize the inputs. An attacker could use this to leak sensitive information.

    first Sep 30, 2021
  • Unscored
    USN-5111-1 2 CVEs

    strongswan vulnerabilities

    It was discovered that strongSwan incorrectly handled certain RSASSA-PSS signatures. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2021-41990) It was discovered that strongSwan incorrectly handled …

    first Oct 19, 2021
  • Low max 3.7
    USN-5104-1 1 CVE

    squid, squid3 vulnerability

    Lyu discovered that Squid incorrectly handled WCCP protocol data. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly obtain sensitive information.

    first Oct 5, 2021
  • Unscored
    USN-5241-1 3 CVEs

    qtsvg-opensource-src vulnerabilities

    It was discovered that QtSvg incorrectly handled certain malformed SVG images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue to cause QtSvg to crash, resulting in a denial of ser…

    first Jan 19, 2022
  • Medium max 6.8
    USN-5105-1 1 CVE

    python-bottle vulnerability

    It was discovered that Bottle incorrectly handled certain inputs. An attacker could possibly use this issue to cache malicious requests.

    first Oct 6, 2021
  • High max 7.5
    USN-5080-1 2 CVEs

    libgcrypt20 vulnerabilities

    It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An attacker could possibly use this issue to recover sensitive information.

    first Sep 16, 2021
  • Unscored
    USN-5048-1 1 CVE

    inetutils vulnerability

    It was discovered that Inetutils telnet server allows remote attackers to execute arbitrary code via short writes or urgent data. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code.

    first Aug 19, 2021
  • High max 7.4
    USN-5051-3 1 CVE

    openssl1.0 vulnerability

    USN-5051-1 fixed a vulnerability in OpenSSL. This update provides the corresponding update for the openssl1.0 package in Ubuntu 18.04 LTS. Original advisory details: Ingo Schwarze discovered that OpenSSL incorrectly handled certain ASN.1 strings. A remote att…

    first Aug 26, 2021
  • Unscored
    USN-5030-1 2 CVEs

    libdbi-perl vulnerabilities

    It was discovered that the Perl DBI module incorrectly opened files outside of the folder specified in the data source name. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2014-10402) It was discovered that the Perl DBI …

    first Aug 4, 2021
  • High max 7.1
    USN-5052-1 1 CVE

    mongodb vulnerability

    MongoDB would fail to properly invalidate existing sessions for deleted users. This could allow a remote authenticated attacker to gain elevated privileges if their user account was recreated with elevated privileges.

    first Aug 26, 2021
  • High max 7.1
    USN-5027-1 1 CVE

    php-pear vulnerability

    It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute arbitrary code.

    first Jul 29, 2021
  • Medium max 5.9
    USN-5022-2 2 CVEs

    mariadb-10.3, mariadb-10.5 vulnerabilities

    USN-5022-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2021-2372 and CVE-2021-2389 in MariaDB 10.3 and 10.5. In addition to security fixes, the updated package contain bug fixes, new features, and possibly inc…

    first Aug 13, 2021