Ubuntu Security Notices (USN)

8,464 results · Feed

• Unscored
  USN-4126-2 3 CVEs

  freetype vulnerabilities

  USN-4126-1 fixed a vulnerability in FreeType. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access …

  Apr 22, 2026

  first Sep 9, 2019
• Unscored
  USN-4110-3 1 CVE

  Dovecot regression

  USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Nick Roessler and Rafi Rubin discovered that Dovecot incorrect…

  Apr 22, 2026

  first Aug 28, 2019
• Critical max 9.8
  USN-4146-1 2 CVEs

  clamav vulnerabilities

  It was discovered that ClamAV incorrectly handled unpacking ZIP files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2019-12625) It was discovered that ClamAV incorrectly handled unpacking bzi…

  Apr 22, 2026

  first Oct 2, 2019
• Unscored
  USN-4100-1 2 CVEs

  kconfig, kde4libs vulnerabilities

  It was discovered that KConfig and KDE libraries have a vulnerability where an attacker could hide malicious code under desktop and configuration files. (CVE-2019-14744) It was discovered that KConfig allows remote attackers to write to arbitrary files via a …

  Apr 22, 2026

  first Aug 16, 2019
• Unscored
  USN-4134-1 1 CVE

  ibus vulnerability

  Simon McVittie discovered that IBus did not enforce appropriate access controls on its private D-Bus socket. A local unprivileged user who discovers the IBus socket address of another user could exploit this to capture the key strokes of the other user.

  Apr 22, 2026

  first Sep 16, 2019
• Unscored
  USN-4160-1 1 CVE

  uw-imap vulnerability

  It was discovered that UW IMAP incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands.

  Apr 22, 2026

  first Oct 21, 2019
• Unscored
  USN-4133-1 2 CVEs

  Wireshark vulnerabilities

  It was discovered that Wireshark improperly handled certain input. A remote or local attacker could cause Wireshark to crash by injecting malformed packets onto the wire or convincing someone to read a malformed packet trace file.

  Apr 22, 2026

  first Sep 16, 2019
• High max 7.3
  USN-4111-1 4 CVEs

  ghostscript vulnerabilities

  Hiroki Matsukuma discovered that the PDF interpreter in Ghostscript did not properly restrict privileged calls when ‘-dSAFER’ restrictions were in effect. If a user or automated system were tricked into processing a specially crafted file, a remote attacker c…

  Apr 22, 2026

  first Aug 29, 2019
• Unscored
  USN-4152-1 1 CVE

  libsoup2.4 vulnerability

  It was discovered that libsoup incorrectly handled parsing certain NTLM messages. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could possibly use this issue to cause a denial of service.

  Apr 22, 2026

  first Oct 9, 2019
• High max 7.5
  USN-4112-1 1 CVE

  ceph vulnerability

  Abhishek Lekshmanan discovered that the RADOS gateway implementation in Ceph did not handle client disconnects properly in some situations. A remote attacker could use this to cause a denial of service.

  Apr 22, 2026

  first Aug 29, 2019
• High max 8.8
  USN-4148-1 8 CVEs

  openexr vulnerabilities

  It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only affected…

  Apr 22, 2026

  first Oct 7, 2019
• Unscored
  USN-4054-2 0 CVEs

  firefox regressions

  USN-4054-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: A sandbox escape was discovered in Firefox. If a user were tricked in …

  Apr 22, 2026

  first Jul 25, 2019
• Unscored
  USN-4073-1 1 CVE

  libebml vulnerability

  It was discovered that libEBML incorrectly handled certain media files. If a user were tricked into opening a specially crafted media file, libEBML could possibly be made to crash, resulting in a denial of service.

  Apr 22, 2026

  first Jul 25, 2019
• Unscored
  USN-4122-1 17 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass Content Security Policy (CSP) protections, bypass same-o…

  Apr 22, 2026

  first Sep 4, 2019
• Unscored
  USN-4134-2 0 CVEs

  ibus regression

  USN-4134-1 fixed a vulnerability in IBus. The security fix introduced a regression when being used with Qt applications. This update reverts the security fix pending further investigation. Original advisory details: Simon McVittie discovered that IBus did not…

  Apr 22, 2026

  first Sep 23, 2019
• Unscored
  USN-4140-1 1 CVE

  firefox vulnerability

  It was discovered that no user notification was given when pointer lock is enabled. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to hijack the mouse pointer and confuse users.

  Apr 22, 2026

  first Sep 25, 2019
• Unscored
  USN-4110-1 1 CVE

  dovecot vulnerability

  Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

  Apr 22, 2026

  first Aug 28, 2019
• High max 7.5
  USN-4142-2 1 CVE

  e2fsprogs vulnerability

  USN-4142-1 fixed a vulnerability in e2fsprogs. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that e2fsprogs incorrectly handled certain ext4 partitions. An attacker could …

  Apr 22, 2026

  first Sep 30, 2019
• Unscored
  USN-4110-2 1 CVE

  dovecot vulnerability

  USN-4110-1 fixed a vulnerability in Dovecot. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker…

  Apr 22, 2026

  first Aug 28, 2019
• Unscored
  USN-4124-1 1 CVE

  exim4 vulnerability

  It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands.

  Apr 22, 2026

  first Sep 6, 2019
• Unscored
  USN-4107-1 3 CVEs

  giflib vulnerabilities

  It was discovered that GIFLIB incorrectly handled certain GIF files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2016-3977) It was discovered that GIFLIB incorrectly handled certain G…

  Apr 22, 2026

  first Aug 20, 2019
• Unscored
  USN-4110-4 1 CVE

  dovecot regression

  USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. We apologize for the inconvenience. Original advisory details: Nick Roessler and Ra…

  Apr 22, 2026

  first Aug 28, 2019
• Unscored
  USN-4120-1 1 CVE

  systemd vulnerability

  It was discovered that the systemd-resolved D-Bus interface did not enforce appropriate access controls. A local unprivileged user could exploit this to modify a system's DNS resolver settings.

  Apr 22, 2026

  first Sep 3, 2019
• Medium max 4.8
  USN-4097-1 2 CVEs

  php7.0, php7.2 vulnerabilities

  It was discovered that PHP incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2019-11041, CVE-2019-11042)

  Apr 22, 2026

  first Aug 13, 2019
• High max 7.5
  USN-4142-1 1 CVE

  e2fsprogs vulnerability

  It was discovered that e2fsprogs incorrectly handled certain ext4 partitions. An attacker could possibly use this issue to execute arbitrary code.

  Apr 22, 2026

  first Sep 30, 2019
• Unscored
  USN-4105-1 2 CVEs

  cups vulnerabilities

  Stephan Zeisberg discovered that the CUPS SNMP backend incorrectly handled encoded ASN.1 inputs. A remote attacker could possibly use this issue to cause CUPS to crash by providing specially crafted network traffic. (CVE-2019-8696, CVE-2019-8675) It was disco…

  Apr 22, 2026

  first Aug 20, 2019
• High max 7.3
  USN-4092-1 1 CVE

  ghostscript vulnerability

  Netanel Fisher discovered that the font handler in Ghostscript did not properly restrict privileged calls when '-dSAFER' restrictions were in effect. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could …

  Apr 22, 2026

  first Aug 12, 2019
• Unscored
  USN-4060-2 2 CVEs

  nss vulnerabilities

  USN-4060-1 fixed several vulnerabilities in nss. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Henry Corrigan-Gibbs discovered that NSS incorrectly handled importing certain curve25519 priv…

  Apr 22, 2026

  first Jul 16, 2019
• Unscored
  USN-4108-1 1 CVE

  libzstd vulnerability

  It was discovered that Zstandard incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.

  Apr 22, 2026

  first Aug 21, 2019
• Unscored
  USN-4055-1 3 CVEs

  flightcrew vulnerabilities

  Mike Salvatore discovered that FlightCrew improperly handled certain malformed EPUB files. An attacker could potentially use this vulnerability to cause a denial of service. (CVE-2019-13032) Mike Salvatore discovered that FlightCrew mishandled certain malform…

  Apr 22, 2026

  first Jul 15, 2019
• High max 7.5
  USN-4090-1 1 CVE

  postgresql-10, postgresql-11, postgresql-9.5 vulnerabilities

  Tom Lane discovered that PostgreSQL did not properly restrict functions declared as "SECURITY DEFINER". An attacker could use this to execute arbitrary SQL with the permissions of the function owner. (CVE-2019-10208) Andreas Seltenreich discovered that Postgr…

  Apr 22, 2026

  first Aug 9, 2019
• Unscored
  USN-4101-1 1 CVE

  firefox vulnerability

  It was discovered that passwords could be copied to the clipboard from the "Saved Logins" dialog without entering the master password, even when a master password has been set. A local attacker could potentially exploit this to obtain saved passwords.

  Apr 22, 2026

  first Aug 16, 2019
• Unscored
  USN-4054-1 21 CVEs

  firefox vulnerabilities

  A sandbox escape was discovered in Firefox. If a user were tricked in to installing a malicious language pack, an attacker could exploit this to gain additional privileges. (CVE-2019-9811) Multiple security issues were discovered in Firefox. If a user were tr…

  Apr 22, 2026

  first Jul 12, 2019
• Unscored
  USN-4130-1 16 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

  Apr 22, 2026

  first Sep 11, 2019
• Unscored
  USN-4066-2 1 CVE

  clamav vulnerability

  USN-4066-1 fixed a vulnerability in libmspack. This update provides the corresponding update for ClamAV in Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that ClamAV incorrectly handled certain CHM files. A remote attacker…

  Apr 22, 2026

  first Jul 22, 2019
• Unscored
  USN-4078-1 2 CVEs

  openldap vulnerabilities

  It was discovered that OpenLDAP incorrectly handled rootDN delegation. A database administrator could use this issue to request authorization as an identity from another database, contrary to expectations. (CVE-2019-13057) It was discovered that OpenLDAP inco…

  Apr 22, 2026

  first Jul 30, 2019
• Unscored
  USN-4120-2 0 CVEs

  systemd regression

  USN-4120-1 fixed a vulnerability in systemd. The update included a recent SRU from the updates pocket that introduced networking problems for some users. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was disc…

  Apr 22, 2026

  first Sep 10, 2019
• Unscored
  USN-4113-2 0 CVEs

  apache2 regression

  USN-4113-1 fixed vulnerabilities in the Apache HTTP server. Unfortunately, that update introduced a regression when proxying balancer manager connections in some configurations. This update fixes the problem. We apologize for the inconvenience. Original advis…

  Apr 22, 2026

  first Sep 17, 2019
• Unscored
  USN-4062-1 4 CVEs

  wavpack vulnerabilities

  Rohan Padhye discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-1010315, CVE-2019-1010317, CVE-2019-1010318, CVE-2019-1010319)

  Apr 22, 2026

  first Jul 16, 2019
• Unscored
  USN-4060-1 3 CVEs

  nss vulnerabilities

  Henry Corrigan-Gibbs discovered that NSS incorrectly handled importing certain curve25519 private keys. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11719) Hubert…

  Apr 22, 2026

  first Jul 16, 2019