Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,437 results · Feed

  • Unscored
    USN-4515-1 1 CVE

    pure-ftpd vulnerability

    Antonio Norales discovered that Pure-FTPd incorrectly handled directory aliases. An attacker could possibly use this issue to access sensitive information. (CVE-2020-9274)

    first Sep 17, 2020
  • Unscored
    USN-4521-1 1 CVE

    libpam-tacplus vulnerability

    It was discovered that pam_tacplus did not properly manage shared secrets if DEBUG loglevel and journald are used. A remote attacker could use this issue to expose sensitive information.

    first Sep 21, 2020
  • Unscored
    USN-4499-1 3 CVEs

    MilkyTracker vulnerabilities

    It was discovered that MilkyTracker did not properly handle certain input. If a user were tricked into opening a malicious file, an attacker could cause MilkyTracker to crash or potentially execute arbitrary code.

    first Sep 15, 2020
  • Unscored
    USN-4524-1 1 CVE

    tnef vulnerabilities

    Paul Dreik discovered that TNEF incorrectly handled filenames. If a user were tricked into opening a specially crafted email attachment, an attacker could possibly use this issue to write arbitrary files to the filesystem or cause TNEF crash, resulting in a d…

    first Sep 21, 2020
  • Unscored
    USN-4501-1 1 CVE

    luajit vulnerability

    It was discovered that an out-of-bounds read existed in LuaJIT. An attacker could use this to cause a denial of service (application crash) or possibly expose sensitive information. (CVE-2020-15890)

    first Sep 15, 2020
  • High max 8.8
    USN-4480-1 4 CVEs

    keystone vulnerabilities

    It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. (CVE-2020-12689, CVE-2020-12691) It was discovered that OpenStack K…

    first Sep 1, 2020
  • Medium max 5.4
    USN-4498-1 1 CVE

    ruby-loofah vulnerability

    It was discovered that Loofah does not properly sanitize JavaScript in sanitized output. An attacker could possibly use this issue to perform XSS attacks. (CVE-2019-15587)

    first Sep 15, 2020
  • Critical max 9.1
    USN-4600-1 4 CVEs

    netty-3.9 vulnerabilities

    It was discovered that Netty had HTTP request smuggling vulnerabilities. A remote attacker could used it to extract sensitive information. (CVE-2019-16869, CVE-2019-20444, CVE-2019-20445, CVE-2020-7238)

    first Oct 22, 2020
  • Unscored
    USN-4461-1 1 CVE

    ark vulnerability

    Dominik Penner discovered that Ark did not properly sanitize zip archive files before performing extraction. An attacker could use this to construct a malicious zip archive that, when opened, would create files outside the extraction directory.

    first Aug 18, 2020
  • High max 8.1
    USN-4430-2 5 CVEs

    pillow vulnerabilities

    USN-4430-1 fixed vulnerabilities in Pillow. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into …

    first Jul 23, 2020
  • High max 8.8
    USN-4407-1 5 CVEs

    libvncserver vulnerabilities

    It was discovered that LibVNCServer incorrectly handled decompressing data. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680) It was discovered that an information disclosure vulnerabi…

    first Jul 1, 2020
  • Unscored
    USN-4535-1 1 CVE

    rdflib vulnerability

    Gabriel Corona discovered that RDFLib did not properly load modules on the command-line. An attacker could possibly use this issue to cause RDFLib to execute arbitrary code. (CVE-2019-7653)

    first Sep 23, 2020
  • Medium max 6.5
    USN-4350-1 25 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.80 in Ubuntu 19.10 and Ubuntu 20.04 LTS. Ubuntu 16.04 LTS and Ubuntu 18.04 LTS have been updated to MySQL…

    first May 4, 2020
  • Unscored
    USN-4374-1 2 CVEs

    unbound vulnerabilities

    Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Unbound incorrectly handled certain queries. A remote attacker could use this issue to perform an amplification attack directed at a target. (CVE-2020-12662) It was discovered that Unbound incorr…

    first May 27, 2020
  • Unscored
    USN-5250-1 1 CVE

    strongswan vulnerability

    Zhuowei Zhang discovered that stringSwan incorrectly handled EAP authentication. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly bypass client and server authentication.

    first Jan 24, 2022
  • Unscored
    USN-4507-1 1 CVE

    ncmpc vulnerability

    It was discovered that ncmpc incorrectly handled long chat messages. A remote attacker could possibly exploit this with a crafted chat message, causing ncmpc to crash, resulting in a denial of service. (CVE-2018-9240)

    first Sep 16, 2020
  • Unscored
    USN-4326-1 14 CVEs

    libiberty vulnerabilities

    It was discovered that libiberty incorrectly handled parsing certain binaries. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of …

    first Apr 8, 2020
  • Unscored
    USN-4475-1 1 CVE

    chrony vulnerability

    It was discovered that Chrony incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause a denial of service or expose sensitive information.

    first Aug 27, 2020
  • Unscored
    USN-4291-1 1 CVE

    libapache2-mod-auth-mellon vulnerability

    It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL.

    first Feb 24, 2020
  • High max 8.8
    USN-4292-1 4 CVEs

    rsync vulnerabilities

    It was discovered that rsync incorrectly handled pointer arithmetic in zlib. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9840, CVE-2016-9841) It was discovered that …

    first Feb 25, 2020
  • Critical max 9.8
    USN-4288-1 1 CVE

    ppp vulnerability

    It was discovered that ppp incorrectly handled certain rhostname values. A remote attacker could use this issue to cause ppp to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Feb 20, 2020
  • Critical max 9.8
    USN-4288-2 1 CVE

    ppp vulnerability

    USN-4288-1 fixed a vulnerability in ppp. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that ppp incorrectly handled certain rhostname values. A remote attacker could use t…

    first Mar 2, 2020
  • Unscored
    USN-4294-1 2 CVEs

    OpenSMTPD vulnerabilities

    It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could use this vulnerability to execute arbitrary shell commands as any non-root user. (CVE-2020-8794) It was discovered that OpenSMTPD did not properly handle hardl…

    first Mar 2, 2020
  • Medium max 6.5
    USN-4420-1 1 CVE

    cinder, python-os-brick vulnerability

    David Hill and Eric Harney discovered that Cinder and os-brick incorrectly handled ScaleIO backend credentials. An attacker could possibly use this issue to expose sensitive information.

    first Jul 7, 2020
  • High max 7.5
    USN-4251-1 2 CVEs

    tomcat8 vulnerabilities

    It was discovered that Tomcat incorrectly handled the RMI registry when configured with the JMX Remote Lifecycle Listener. A local attacker could possibly use this issue to obtain credentials and gain complete control over the Tomcat instance. (CVE-2019-12418…

    first Jan 27, 2020
  • Medium max 5.9
    USN-4250-2 1 CVE

    mariadb-10.1, mariadb-10.3 vulnerability

    It was discovered that an unspecified vulnerability existed in the C API component of MariaDB. An attacker could use this to cause a denial of service for MariaDB clients. MariaDB has been updated to 10.3.22 in Ubuntu 19.10 and 10.1.44 in Ubuntu 18.04 LTS. In…

    first Feb 6, 2020
  • Medium max 6.5
    USN-4250-1 14 CVEs

    mysql-5.7, mysql-8.0 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.19 in Ubuntu 19.10. Ubuntu 16.04 LTS and Ubuntu 18.04 LTS have been updated to MySQL 5.7.29. In addition …

    first Jan 27, 2020
  • Unscored
    USN-4156-2 11 CVEs

    libsdl1.2 vulnerabilities

    USN-4156-1 fixed several vulnerabilities in SDL. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that SDL incorrectly handled certain images. If a user were tricked into ope…

    first Oct 16, 2019
  • Unscored
    USN-4156-1 12 CVEs

    libsdl1.2 vulnerabilities

    It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Oct 15, 2019
  • Unscored
    USN-3799-1 21 CVEs

    mysql-5.5, mysql-5.7 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.62 in Ubuntu 14.04 LTS. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10 have been updated to MySQL 5…

    first Oct 23, 2018
  • Unscored
    USN-4109-1 5 CVEs

    openjpeg2 vulnerabilities

    It was discovered that OpenJPEG incorrectly handled certain PGX files. An attacker could possibly use this issue to cause a denial of service or possibly remote code execution. (CVE-2017-17480) It was discovered that OpenJPEG incorrectly handled certain files…

    first Aug 21, 2019
  • Medium max 6.5
    USN-4165-1 13 CVEs

    firefox vulnerabilities

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, bypass same-origin restrictions, con…

    first Oct 23, 2019
  • High max 7.5
    USN-4113-1 6 CVEs

    apache2 vulnerabilities

    Stefan Eissing discovered that the HTTP/2 implementation in Apache did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in some situations. A remote attacker could use this to cause a denial of service (daemon crash). This issue only affected Ubun…

    first Aug 29, 2019
  • Medium max 5.9
    USN-3999-1 4 CVEs

    gnutls28 vulnerabilities

    Eyal Ronen, Kenneth G. Paterson, and Adi Shamir discovered that GnuTLS was vulnerable to a timing side-channel attack known as the "Lucky Thirteen" issue. A remote attacker could possibly use this issue to perform plaintext-recovery attacks via analysis of ti…

    first May 30, 2019
  • Unscored
    USN-3877-1 12 CVEs

    libvncserver vulnerabilities

    It was discovered that LibVNCServer incorrectly handled certain operations. A remote attacker able to connect to applications using LibVNCServer could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary cod…

    first Jan 31, 2019
  • Critical max 9.8
    USN-3685-1 9 CVEs

    ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities

    Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) It…

    first Jun 13, 2018
  • Critical max 9.8
    USN-3665-1 6 CVEs 1 exploited

    tomcat7, tomcat8 vulnerabilities

    It was discovered that Tomcat incorrectly handled being configured with HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP file to the server and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ub…

    first May 30, 2018
  • Critical max 9.8
    USN-3439-1 7 CVEs

    ruby1.9.1 vulnerabilities

    It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) Yusuke Endoh discovered that Ruby incorrectly handled certain files. An attacker could use this to execute terminal escape se…

    first Oct 5, 2017
  • Unscored
    USN-3367-1 11 CVEs

    gdb vulnerabilities

    Hanno Böck discovered that gdb incorrectly handled certain malformed AOUT headers in PE executables. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause gdb to crash, resulting…

    first Jul 26, 2017
  • Unscored
    USN-4722-1 2 CVEs

    minidlna vulnerabilities

    It was discovered that ReadyMedia (MiniDLNA) allowed subscription requests with a delivery URL on a different network segment than the fully qualified event- subscription URL. An attacker could use this to hijack smart devices and cause denial of service atta…

    first Feb 4, 2021