Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,437 results · Feed

  • Medium max 6.0
    USN-5022-1 31 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.26 in Ubuntu 20.04 LTS and Ubuntu 21.04. Ubuntu 18.04 LTS has been updated to MySQL 5.7.35. In addition t…

    first Jul 26, 2021
  • Medium max 6.2
    USN-5019-1 3 CVEs

    nvidia-graphics-drivers-390, nvidia-graphics-drivers-418-server, nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-460, nvidia-graphics-drivers-460-server, nvidia-graphics-drivers-470 vulnerabilities

    It was discovered that an assert() could be triggered in the NVIDIA graphics drivers. A local attacker could use this to cause a denial of service. (CVE-2021-1093) It was discovered that the NVIDIA graphics drivers permitted an out-of-bounds array access. A l…

    first Jul 21, 2021
  • Unscored
    USN-5069-1 1 CVE

    libapache2-mod-auth-mellon vulnerability

    It was discovered that mod-auth-mellon incorrectly filtered certain URLs. A remote attacker could possibly use this issue to perform an open redirect attack.

    first Sep 8, 2021
  • Unscored
    USN-4970-1 1 CVE

    gupnp vulnerability

    It was discovered that GUPnP incorrectly filtered local requests. If a user were tricked into visiting a malicious website, a remote attacker could possibly use this issue to perform actions against local UPnP services such as obtaining or altering sensitive …

    first Jun 1, 2021
  • Unscored
    USN-4992-1 6 CVEs

    grub2-signed, grub2-unsigned vulnerabilities

    Máté Kukri discovered that the acpi command in GRUB 2 allowed privileged users to load crafted ACPI tables when secure boot is enabled. An attacker could use this to bypass UEFI Secure Boot restrictions. (CVE-2020-14372) Chris Coulson discovered that the rmmo…

    first Jun 18, 2021
  • Unscored
    USN-5110-1 1 CVE

    ardour vulnerability

    It was discovered that Ardour incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

    first Oct 18, 2021
  • Medium max 6.6
    USN-4935-1 2 CVEs

    nvidia-graphics-drivers-390, nvidia-graphics-drivers-418-server, nvidia-graphics-drivers-450, nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-460, nvidia-graphics-drivers-460-server vulnerabilities

    It was discovered that the NVIDIA GPU display driver for the Linux kernel incorrectly performed access control. A local attacker could use this issue to cause a denial of service, expose sensitive information, or escalate privileges. (CVE-2021-1076) It was di…

    first May 4, 2021
  • Unscored
    USN-4925-1 1 CVE

    shibboleth-sp vulnerability

    Toni Huttunen and Fraktal Oy discovered that the Shibboleth Service provider allowed content injection due to allowing attacker-controlled parameters in error or other status pages. An attacker could use this to inject malicious content.

    first Apr 22, 2021
  • Medium max 5.3
    USN-4892-1 1 CVE

    openjdk-8, openjdk-lts vulnerability

    It was discovered that OpenJDK incorrectly verified Jar signatures. An attacker could possibly use this issue to bypass intended security restrictions when using Jar files signed with a disabled algorithm.

    first Apr 27, 2021
  • Medium max 5.3
    USN-4902-1 1 CVE

    python-django vulnerability

    Dennis Brinkrolf discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwrite files in unexpected directories.

    first Apr 6, 2021
  • High max 7.5
    USN-4897-1 1 CVE

    pygments vulnerability

    Ben Caller discovered that Pygments incorrectly handled parsing certain files. If a user or automated system were tricked into parsing a specially crafted file, a remote attacker could cause Pygments to hang or consume resources, resulting in a denial of serv…

    first Mar 30, 2021
  • Unscored
    USN-4906-1 1 CVE

    nettle vulnerability

    It was discovered that Nettle incorrectly handled signature verification. A remote attacker could use this issue to cause Nettle to crash, resulting in a denial of service, or possibly force invalid signatures.

    first Apr 13, 2021
  • Unscored
    USN-4880-1 5 CVEs

    openjpeg2 vulnerabilities

    It was discovered that OpenJPEG incorrectly handled certain image data. An attacker could use this issue to cause OpenJPEG to crash, leading to a denial of service, or possibly execute arbitrary code.

    first Mar 16, 2021
  • Medium max 6.3
    USN-4881-1 1 CVE

    containerd vulnerability

    It was discovered that containerd incorrectly handled certain environment variables. Contrary to expectations, a container could receive environment variables defined for a different container, possibly containing sensitive information.

    first Mar 17, 2021
  • High max 7.5
    USN-4866-1 4 CVEs

    netty vulnerabilities

    It was discovered that Netty incorrectly implements HTTP/2. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515, CVE-2019-9518)

    first Jun 29, 2021
  • High max 7.1
    USN-4697-2 2 CVEs

    pillow vulnerabilities

    USN-4697-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tr…

    first Jan 20, 2021
  • Unscored
    USN-4730-1 1 CVE

    postsrsd vulnerability

    It was discovered that PostSRSd mishandled certain input. A remote attacker could use this vulnerability to cause a denial of service via a long timestamp tag in an SRS address.

    first Feb 10, 2021
  • Medium max 5.9
    USN-4858-1 2 CVEs

    gradle vulnerabilities

    It was discovered that Gradle used an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins were used. A remote unauthenticated attacker could possibly use this issue to perform a machine-in-the-middle attack. …

    first Mar 15, 2021
  • Critical max 9.8
    USN-4741-1 3 CVEs

    libjackson-json-java vulnerabilities

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.

    first Feb 18, 2021
  • Unscored
    USN-4830-1 1 CVE

    okular vulnerability

    It was discovered that Okular mishandled certain crafted archives during extraction. An attacker could use this vulnerability to write arbitrary files to the filesystem.

    first Mar 15, 2021
  • Medium max 4.2
    USN-4834-1 1 CVE

    prosody vulnerability

    It was discovered that Prosody incorrectly validated the virtual host associated with a user session across stream restarts. A remote attacker could use this issue to gain unintended access to resources.

    first Mar 15, 2021
  • Unscored
    USN-4758-1 1 CVE

    golang-1.10, golang-1.14 vulnerability

    It was discovered that Go applications incorrectly handled uploaded content. If a user were tricked into visiting a malicious page, a remote attacker could exploit this with a crafted file to conduct cross-site scripting (XSS) attacks.

    first Mar 8, 2021
  • Unscored
    USN-4759-1 2 CVEs

    glib2.0 vulnerabilities

    Krzesimir Nowak discovered that GLib incorrectly handled certain large buffers. A remote attacker could use this issue to cause applications linked to GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-27218) Kevin …

    first Mar 8, 2021
  • Medium max 4.4
    USN-4731-1 1 CVE

    junit4 vulnerability

    It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could possibly use this issue to obtain sensitive information.

    first Feb 10, 2021
  • Critical max 9.1
    USN-4963-1 6 CVEs

    pillow vulnerabilities

    It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash or hand, resulting in a denial of service.

    first May 19, 2021
  • Unscored
    USN-4764-1 1 CVE

    glib2.0 vulnerability

    It was discovered that GLib incorrectly handled certain symlinks when replacing files. If a user or automated system were tricked into extracting a specially crafted file with File Roller, a remote attacker could possibly create files outside of the intended …

    first Mar 15, 2021
  • Critical max 9.8
    USN-4763-1 8 CVEs

    pillow vulnerabilities

    It was discovered that Pillow incorrectly handled certain Tiff image files. If a user or automated system were tricked into opening a specially-crafted Tiff file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly exe…

    first Mar 11, 2021
  • Critical max 9.8
    USN-4740-1 2 CVEs

    shiro vulnerabilities

    It was discovered that Apache Shiro mishandled specially crafted requests. An attacker could use this vulnerability to bypass authentication mechanisms.

    first Feb 18, 2021
  • Unscored
    USN-4707-1 1 CVE

    tcmu vulnerability

    It was discovered that TCMU lacked a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request.

    first Jan 28, 2021
  • High max 8.1
    USN-4599-2 7 CVEs

    firefox vulnerabilities

    USN-4599-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubuntu 16.04 LTS. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website,…

    first Oct 26, 2020
  • High max 7.5
    USN-4596-1 4 CVEs

    tomcat9 vulnerabilities

    It was discovered that Tomcat did not properly manage HTTP/2 streams. An attacker could possibly use this to cause Tomcat to consume resources, resulting in a denial of service. (CVE-2020-11996) It was discovered that Tomcat did not properly release the HTTP/…

    first Oct 21, 2020
  • Unscored
    USN-4536-1 7 CVEs

    spip vulnerabilities

    Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2019-16392) Gilles Vincent discovered that SPIP incorrectly handled password …

    first Sep 24, 2020
  • Low max 3.7
    USN-4504-1 4 CVEs

    openssl, openssl1.0 vulnerabilities

    Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie-Hellman ciphersuites in the TLS specification and implemented by OpenSSL contained a flaw. A remote attacker could possibly use this issue to eavesdrop on encr…

    first Sep 16, 2020
  • Low max 3.5
    USN-4481-1 10 CVEs

    freerdp2 vulnerabilities

    It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Sep 1, 2020
  • Critical max 9.8
    USN-4459-1 5 CVEs 2 exploited

    salt vulnerabilities

    It was discovered that Salt allows remote attackers to determine which files exist on the server. An attacker could use that to extract sensitive information. (CVE-2018-15750) It was discovered that Salt has a vulnerability that allows an user to bypass authe…

    first Aug 13, 2020
  • Low max 3.1
    USN-4316-2 2 CVEs

    libgd2 vulnerabilities

    USN-4316-1 fixed a vulnerability in GD Graphics Library. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that GD Graphics Library incorrectly handled cloning an image. An attacker could possibly…

    first Apr 2, 2020
  • Unscored
    USN-4298-1 12 CVEs

    sqlite3 vulnerabilities

    It was discovered that SQLite incorrectly handled certain shadow tables. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-13734, CVE-2019-13750, CVE-2019-13753) It was d…

    first Mar 10, 2020
  • Unscored
    USN-4192-1 30 CVEs

    imagemagick vulnerabilities

    It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

    first Nov 14, 2019
  • Unscored
    USN-4191-2 5 CVEs

    qemu vulnerabilities

    USN-4191-2 fixed a vulnerability in QEMU. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that the LSI SCSI adapter emulator implementation in QEMU did not properly validate executed scripts. A …

    first Nov 14, 2019
  • Unscored
    USN-4734-1 2 CVEs

    wpa vulnerabilities

    It was discovered that wpa_supplicant did not properly handle P2P (Wi-Fi Direct) group information in some situations, leading to a heap overflow. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. …

    first Feb 11, 2021