Ubuntu Security Notices (USN)

8,464 results · Feed

• Medium max 6.5
  USN-5543-1 6 CVEs

  net-snmp vulnerabilities

  Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled memory operations when processing certain requests. A remote attacker could use this issue to cause Net-SNMP to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Aug 1, 2022
• Unscored
  USN-5583-1 1 CVE

  systemd vulnerability

  It was discovered that systemd incorrectly handled certain DNS requests, which leads to user-after-free vulnerability. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-2526)

  Apr 22, 2026

  first Aug 29, 2022
• Unscored
  USN-5554-1 1 CVE

  gdk-pixbuf vulnerability

  Pedro Ribeiro discovered that the GDK-PixBuf library did not properly handle certain GIF images. If an user or automated system were tricked into opening a specially crafted GIF file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulti…

  Apr 22, 2026

  first Aug 8, 2022
• High max 7.7
  USN-5530-1 1 CVE

  php8.1 vulnerability

  It was discovered that PHP incorrectly handled certain memory operations when obtaining file information. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jul 25, 2022
• High max 7.7
  USN-5523-2 5 CVEs

  tiff vulnerabilities

  USN-5523-1 fixed several vulnerabilities in LibTIFF. This update provides the fixes for CVE-2022-0907, CVE-2022-0908, CVE-2022-0909, CVE-2022-0924 and CVE-2022-22844 for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that …

  Apr 22, 2026

  first Sep 12, 2022
• High max 8.8
  USN-5506-1 2 CVEs

  nss vulnerabilities

  Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.…

  Apr 22, 2026

  first Jul 7, 2022
• Unscored
  USN-5495-2 0 CVEs

  curl regression

  USN-5495-1 fixed vulnerabilities in curl. The fix for CVE-2022-32205 miscalculated the maximum cookie size, causing a regression. This update fixes the problem. Original advisory details: Harry Sintonen discovered that curl incorrectly handled certain cookies…

  Apr 22, 2026

  first Sep 29, 2025
• Unscored
  USN-5528-1 4 CVEs

  freetype vulnerabilities

  It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jul 20, 2022
• High max 8.8
  USN-5494-1 2 CVEs

  mozjs91 vulnerabilities

  It was discovered that SpiderMonkey JavaScript Library incorrectly generated certain assembly code. An remote attacker could possibly use this issue to cause a crash or expose sensitive information. (CVE-2022-28285) It was discovered that SpiderMonkey JavaScr…

  Apr 22, 2026

  first Jun 27, 2022
• Critical max 9.8
  USN-5536-1 6 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the mouse pointer position, bypass Subresource Integrity prot…

  Apr 22, 2026

  first Jul 28, 2022
• Critical max 9.8
  USN-5495-1 4 CVEs

  curl vulnerabilities

  Harry Sintonen discovered that curl incorrectly handled certain cookies. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 21.10, and Ubuntu 22.04 LTS. (CVE-2022-32205) Harry Sintonen discovered that curl …

  Apr 22, 2026

  first Jun 27, 2022
• High max 8.8
  USN-5522-1 2 CVEs

  webkit2gtk vulnerabilities

  Several security issues were discovered in WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attac…

  Apr 22, 2026

  first Jul 18, 2022
• Critical max 9.8
  USN-5475-1 12 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the browser UI, conduct cross-s…

  Apr 22, 2026

  first Jun 13, 2022
• Unscored
  USN-5481-1 0 CVEs

  bluez vulnerabilities

  It was discovered that BlueZ incorrectly validated certain capabilities and lengths when handling the A2DP profile. A remote attacker could use this issue to cause BlueZ to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jun 15, 2022
• Critical max 9.8
  USN-5512-1 17 CVEs

  thunderbird vulnerabilities

  Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the U…

  Apr 22, 2026

  first Jul 14, 2022
• Unscored
  USN-5474-2 1 CVE

  varnish regression

  USN-5474-1 fixed vulnerabilities in Varnish Cache. Unfortunately the fix for CVE-2020-11653 was incomplete. This update fixes the problem. Original advisory details: It was discovered that Varnish Cache could have an assertion failure when a TLS termination p…

  Apr 22, 2026

  first Aug 23, 2022
• Medium max 6.7
  USN-5463-1 8 CVEs

  ntfs-3g vulnerabilities

  It was discovered that NTFS-3G incorrectly handled the ntfsck tool. If a user or automated system were tricked into using ntfsck on a specially crafted disk image, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2021-46790) Rom…

  Apr 22, 2026

  first Jun 7, 2022
• Unscored
  USN-5450-1 2 CVEs

  subversion vulnerabilities

  Evgeny Kotkov discovered that subversion servers did not properly follow path-based authorization rules in certain cases. An attacker could potentially use this issue to retrieve information about private paths. (CVE-2021-28544) Thomas Weißschuh discovered th…

  Apr 22, 2026

  first May 27, 2022
• Unscored
  USN-5441-1 0 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site s…

  Apr 22, 2026

  first May 24, 2022
• High max 8.8
  USN-5457-1 5 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site s…

  Apr 22, 2026

  first Jun 1, 2022
• Critical max 9.8
  USN-5451-1 1 CVE

  influxdb vulnerability

  Ilya Averyanov discovered that an InfluxDB vulnerability allowed attackers to bypass authentication and gain access to any known database user.

  Apr 22, 2026

  first May 31, 2022
• Critical max 9.8
  USN-5435-1 10 CVEs

  thunderbird vulnerabilities

  Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass permission prompts, obtain sensiti…

  Apr 22, 2026

  first May 25, 2022
• High max 8.8
  USN-5434-1 2 CVEs

  firefox vulnerabilities

  It was discovered that the methods of an Array object could be corrupted as a result of prototype pollution by sending a message to the parent process. If a user were tricked into opening a specially crafted website, an attacker could exploit this to execute …

  Apr 22, 2026

  first May 23, 2022
• Unscored
  USN-5462-1 2 CVEs

  ruby2.5, ruby2.7, ruby3.0 vulnerabilities

  It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-28738) It was discovered that Ruby incorrectly handled certa…

  Apr 22, 2026

  first Jun 6, 2022
• Critical max 9.8
  USN-5430-1 1 CVE

  gnome-control-center vulnerability

  It was discovered that GNOME Settings incorrectly handled the remote desktop sharing configuration. When turning off desktop sharing, it may be turned on again after rebooting, contrary to expectations.

  Apr 22, 2026

  first May 18, 2022
• Unscored
  USN-5454-1 3 CVEs

  cups vulnerabilities

  Joshua Mason discovered that CUPS incorrectly handled the secret key used to access the administrative web interface. A remote attacker could possibly use this issue to open a session as an administrator and execute arbitrary code. (CVE-2022-26691) It was dis…

  Apr 22, 2026

  first May 31, 2022
• High max 7.5
  USN-5429-1 1 CVE

  bind9 vulnerability

  Thomas Amgarten discovered that Bind incorrectly handled certain TLS connections being destroyed. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.

  Apr 22, 2026

  first May 18, 2022
• Unscored
  USN-5424-1 1 CVE

  openldap vulnerability

  It was discovered that OpenLDAP incorrectly handled certain SQL statements within LDAP queries in the experimental back-sql backend. A remote attacker could possibly use this issue to perform an SQL injection attack and alter the database.

  Apr 22, 2026

  first May 17, 2022
• Unscored
  USN-5445-1 3 CVEs

  subversion vulnerabilities

  Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11782) T…

  Apr 22, 2026

  first May 26, 2022
• Critical max 9.8
  USN-5411-1 8 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass permission prompts, obtain sensitive i…

  Apr 22, 2026

  first May 11, 2022
• Medium max 5.5
  USN-5439-1 1 CVE

  accountsservice vulnerability

  Gunnar Hjalmarsson discovered that AccountsService incorrectly dropped privileges. A local user could possibly use this issue to cause AccountsService to crash or stop responding, resulting in a denial of service. (CVE-2022-1804)

  Apr 22, 2026

  first May 24, 2022
• Unscored
  USN-5403-1 1 CVE

  sqlite3 vulnerability

  It was discovered that SQLite command-line component incorrectly handled certain queries. An attacker could possibly use this issue to cause a crash or possibly execute arbitrary code.

  Apr 22, 2026

  first May 5, 2022
• High max 8.6
  USN-5423-1 5 CVEs

  clamav vulnerabilities

  Michał Dardas discovered that ClamAV incorrectly handled parsing CHM files. A remote attacker could possibly use this issue to cause ClamAV to stop responding, resulting in a denial of service. (CVE-2022-20770) Michał Dardas discovered that ClamAV incorrectly…

  Apr 22, 2026

  first May 17, 2022
• Unscored
  USN-5396-1 1 CVE

  ghostscript vulnerability

  It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to access arbitrary files, execute arbitrary …

  Apr 22, 2026

  first Apr 28, 2022
• High max 8.8
  USN-5394-1 4 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site s…

  Apr 22, 2026

  first Apr 28, 2022
• Unscored
  USN-5410-1 1 CVE

  nss vulnerability

  Lenny Wang discovered that NSS incorrectly handled certain messages. A remote attacker could possibly use this issue to cause servers compiled with NSS to stop responding, resulting in a denial of service.

  Apr 22, 2026

  first May 11, 2022
• High max 8.8
  USN-5378-2 1 CVE

  xz-utils vulnerability

  Cleemy Desu Wayo discovered that XZ Utils incorrectly handled certain filenames. If a user or automated system were tricked into performing xzgrep operations with specially crafted filenames, a remote attacker could overwrite arbitrary files.

  Apr 22, 2026

  first Apr 13, 2022
• Unscored
  USN-5382-1 1 CVE

  libinput vulnerability

  Albin Eldstål-Ahrens and Lukas Lamster discovered libinput did not properly handle input devices with specially crafted names. A local attacker with physical access could use this to cause libinput to crash or expose sensitive information.

  Apr 22, 2026

  first Apr 20, 2022
• Unscored
  USN-5401-1 2 CVEs

  dpdk vulnerabilities

  Wenxiang Qian discovered that DPDK incorrectly checked certain payloads. An attacker could use this issue to cause DPDK to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3839) It was discovered that DPDK incorrectly han…

  Apr 22, 2026

  first May 4, 2022
• Unscored
  USN-6227-1 2 CVEs

  mozjs102 vulnerabilities

  Several security issues were discovered in the SpiderMonkey JavaScript library. If a user were tricked into opening malicious JavaScript applications or processing malformed data, a remote attacker could exploit a variety of issues related to JavaScript secur…

  Apr 22, 2026

  first Jul 13, 2023