Ubuntu Security Notices (USN)

8,464 results · Feed

• High max 8.8
  USN-5370-1 11 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, execute script unexpectedly, obtain sensitive information, conduct …

  Apr 22, 2026

  first Apr 7, 2022
• Unscored
  USN-5400-3 0 CVEs

  mysql-8.0 regression

  USN-5400-1 fixed vulnerabilities in MySQL. The fix breaks existing charm configurations. This updated fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in MySQL and this update includes …

  Apr 22, 2026

  first May 5, 2022
• Unscored
  USN-5372-1 2 CVEs

  subversion vulnerabilities

  Evgeny Kotkov discovered that Subversion servers did not properly follow path-based authorization rules in certain cases. An attacker could potentially use this issue to retrieve information about private paths. (CVE-2021-28544) Thomas Weißschuh discovered th…

  Apr 22, 2026

  first Apr 12, 2022
• Unscored
  USN-5382-2 1 CVE

  libinput vulnerability

  USN-5382-1 fixed a vulnerability in libinput. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: Albin Eldstål-Ahrens and Lukas Lamster discovered libinput did not properly handle input devices with specially craft…

  Apr 22, 2026

  first May 2, 2022
• High max 8.8
  USN-5393-1 8 CVEs

  thunderbird vulnerabilities

  Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct spoofing attacks, or execute arbi…

  Apr 22, 2026

  first Apr 27, 2022
• Unscored
  USN-5374-1 1 CVE

  libarchive vulnerability

  It was discovered that libarchive incorrectly handled certain archive files. An attacker could possibly use this issue to expose sensitive information.

  Apr 22, 2026

  first Apr 11, 2022
• Unscored
  USN-5366-1 3 CVEs

  fribidi vulnerabilities

  It was discovered that FriBidi incorrectly handled processing of input strings resulting in memory corruption. An attacker could use this issue to cause FriBidi to crash, resulting in a denial of service, or potentially execute arbitrary code. (CVE-2022-25308…

  Apr 22, 2026

  first Apr 7, 2022
• Unscored
  USN-5366-2 3 CVEs

  fribidi vulnerabilities

  USN-5366-1 fixed several vulnerabilities in FriBidi. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that FriBidi incorrectly handled processing of input strings resulting in memory corruption.…

  Apr 22, 2026

  first Apr 27, 2022
• High max 7.5
  USN-5355-1 1 CVE

  zlib vulnerability

  Danilo Ramos discovered that zlib incorrectly handled memory when performing certain deflating operations. An attacker could use this issue to cause zlib to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Mar 30, 2022
• Critical max 9.6
  USN-5345-1 13 CVEs

  thunderbird vulnerabilities

  Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, obtain sens…

  Apr 22, 2026

  first Mar 23, 2022
• Medium max 5.7
  USN-5342-3 1 CVE

  python3.7 vulnerability

  USN-5342-1 fixed several vulnerabilities in Python. This update provides the corresponding fix for CVE-2021-3426 for Ubuntu 18.04 ESM. Original advisory details: David Schwörer discovered that Python incorrectly handled certain inputs. An attacker could possi…

  Apr 22, 2026

  first May 23, 2022
• Unscored
  USN-5330-1 1 CVE

  libreoffice vulnerability

  It was discovered that LibreOffice incorrectly handled digital signatures. An attacker could possibly use this issue to create a specially crafted document that would display a validly signed indicator, contrary to expectations.

  Apr 22, 2026

  first Mar 15, 2022
• High max 7.5
  USN-5324-1 1 CVE

  libxml2 vulnerability

  It was discovered that libxml2 incorrectly handled certain XML files. An attacker could use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Mar 14, 2022
• Medium max 6.8
  USN-5332-1 2 CVEs

  bind9 vulnerabilities

  Xiang Li, Baojun Liu, Chaoyi Lu, and Changgen Zou discovered that Bind incorrectly handled certain bogus NS records when using forwarders. A remote attacker could possibly use this issue to manipulate cache results. (CVE-2021-25220) It was discovered that Bin…

  Apr 22, 2026

  first Mar 17, 2022
• Critical max 9.6
  USN-5321-2 7 CVEs

  firefox vulnerabilities

  USN-5321-1 fixed vulnerabilities in Firefox. The update didn't include arm64 because of a regression. This update provides the corresponding update for arm64. This update also removes Yandex and Mail.ru as optional search providers in the drop-down search men…

  Apr 22, 2026

  first Mar 17, 2022
• Critical max 9.6
  USN-5314-1 2 CVEs 2 exploited

  firefox vulnerabilities

  A use-after-free was discovered when removing an XSLT parameter in some circumstances. If a user were tricked into opening a specially crafted website, an attacker could exploit this to cause a denial of service, or execute arbitrary code. (CVE-2022-26485) A …

  Apr 22, 2026

  first Mar 6, 2022
• Unscored
  USN-5304-1 1 CVE

  policykit-1 vulnerability

  Kevin Backhouse discovered that PolicyKit incorrectly handled file descriptors. A local attacker could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service.

  Apr 22, 2026

  first Feb 28, 2022
• Unscored
  USN-5321-3 0 CVEs

  firefox regressions

  USN-5321-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tri…

  Apr 22, 2026

  first Mar 24, 2022
• Critical max 9.6
  USN-5321-1 7 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass security restrictions, obtain sensitiv…

  Apr 22, 2026

  first Mar 10, 2022
• Unscored
  USN-5306-1 3 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site s…

  Apr 22, 2026

  first Feb 28, 2022
• Unscored
  USN-5301-1 1 CVE

  cyrus-sasl2 vulnerability

  It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.

  Apr 22, 2026

  first Feb 22, 2022
• Critical max 9.6
  USN-5284-1 9 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, obtain sensitive information, or exec…

  Apr 22, 2026

  first Feb 14, 2022
• Unscored
  USN-5333-1 4 CVEs

  apache2 vulnerabilities

  Chamal De Silva discovered that the Apache HTTP Server mod_lua module incorrectly handled certain crafted request bodies. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2022-22719) James Ke…

  Apr 22, 2026

  first Mar 17, 2022
• Unscored
  USN-5291-1 3 CVEs

  libarchive vulnerabilities

  It was discovered that libarchive incorrectly handled symlinks. If a user or automated system were tricked into processing a specially crafted archive, an attacker could possibly use this issue to change modes, times, ACLs, and flags on arbitrary files. (CVE-…

  Apr 22, 2026

  first Feb 17, 2022
• Medium max 5.5
  USN-5279-1 2 CVEs

  util-linux vulnerabilities

  It was discovered that util-linux incorrectly handled unmounting FUSE filesystems. A local attacker could possibly use this issue to unmount FUSE filesystems belonging to other users.

  Apr 22, 2026

  first Feb 9, 2022
• High max 8.8
  USN-5260-2 1 CVE

  samba vulnerability

  Orange Tsai discovered that the Samba vfs_fruit module incorrectly handled certain memory operations. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code as root. (CVE-2021-44142)

  Apr 22, 2026

  first Feb 1, 2022
• Unscored
  USN-5267-2 0 CVEs

  linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4 regression

  USN-5267-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a regression that caused the kernel to freeze when accessing CIFS shares in some situations. This update fixes the problem. We apologize for the inconvenience. Origina…

  Apr 22, 2026

  first Feb 11, 2022
• Unscored
  USN-5286-1 1 CVE

  cryptsetup vulnerability

  Milan Broz discovered that cryptsetup incorrectly handled LUKS2 reencryption recovery. An attacker with physical access to modify the encrypted device header may trigger the device to be unencrypted the next time it is mounted by the user. On Ubuntu 20.04 LTS…

  Apr 22, 2026

  first Feb 15, 2022
• Unscored
  USN-5256-1 2 CVEs

  uriparser vulnerabilities

  It was discovered that uriparser incorrectly handled certain memory operations. An attacker could use this to cause a denial of service. (CVE-2021-46141, CVE-2021-46142)

  Apr 22, 2026

  first Jul 13, 2022
• High max 8.2
  USN-5303-1 1 CVE

  php7.4, php8.0 vulnerability

  It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Feb 28, 2022
• High max 7.8
  USN-5252-1 1 CVE 1 exploited

  policykit-1 vulnerability

  It was discovered that the PolicyKit pkexec tool incorrectly handled command-line arguments. A local attacker could use this issue to escalate privileges to an administrator.

  Apr 22, 2026

  first Jan 25, 2022
• Unscored
  USN-5213-1 2 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site s…

  Apr 22, 2026

  first Jan 6, 2022
• High max 7.5
  USN-5199-1 2 CVEs

  python3.6 vulnerabilities

  It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex with a quadratic worst-case time complexity. Specially crafted traffic from a malicious HTTP server could cause a regular expression denial of service (ReDoS) co…

  Apr 22, 2026

  first Dec 17, 2021
• Unscored
  USN-5168-2 1 CVE

  thunderbird vulnerability

  Tavis Ormandy discovered that NSS, included with Thunderbird, incorrectly handled verifying DSA/RSA-PSS signatures. A remote attacker could use this issue to cause Thunderbird to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Dec 1, 2021
• Unscored
  USN-5194-1 1 CVE

  olm vulnerability

  Denis Kasak discovered that Olm was not verifying the length of input being processed by the olm_pk_decrypt module, which introduced a stack-based buffer overflow vulnerability to the library. An attacker could use this to cause a denial of service (applicati…

  Apr 22, 2026

  first Dec 15, 2021
• Unscored
  USN-5210-2 0 CVEs

  linux, linux-gcp, linux-gcp-5.4, linux-hwe-5.4 regression

  USN-5210-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a regression that caused failures to boot in environments with AMD Secure Encrypted Virtualization (SEV) enabled. This update fixes the problem. We apologize for the i…

  Apr 22, 2026

  first Jan 12, 2022
• High max 7.5
  USN-5201-1 1 CVE

  python3.8, python3.9 vulnerabilities

  It was discovered that the Python urllib http client could enter into an infinite loop when incorrectly handling certain server responses (100 Continue response). Specially crafted traffic from a malicious HTTP server could cause a denial of service (Dos) con…

  Apr 22, 2026

  first Dec 17, 2021
• High max 7.5
  USN-5233-1 1 CVE

  clamav vulnerability

  It was discovered that ClamAV incorrectly handled memory when the CL_SCAN_GENERAL_COLLECT_METADATA scan option was enabled. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service.

  Apr 22, 2026

  first Jan 18, 2022
• Unscored
  USN-5193-1 4 CVEs

  xorg-server, xorg-server-hwe-18.04, xwayland vulnerabilities

  Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain inputs. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code and escalate privileges.

  Apr 22, 2026

  first Dec 14, 2021
• Unscored
  USN-5174-2 0 CVEs

  samba regression

  USN-5174-1 fixed vulnerabilities in Samba. Some of the changes introduced a regression in Kerberos authentication in certain environments. Please see the following upstream bug for more information: https://bugzilla.samba.org/show_bug.cgi?id=14922 This update…

  Apr 22, 2026

  first Dec 13, 2021