Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,464 results · Feed

  • Unscored
    USN-4126-1 1 CVE

    freetype vulnerability

    It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information.

    first Sep 9, 2019
  • Unscored
    USN-4066-1 1 CVE

    libmspack vulnerability

    It was discovered that libmspack incorrectly handled certain CHM files. A remote attacker could possibly use this issue to access sensitive information.

    first Jul 18, 2019
  • Unscored
    USN-4115-2 0 CVEs

    linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2 regression

    USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update, a regression was introduced that caused a kernel crash when handling fragmented packets in some situations. This update …

    first Sep 11, 2019
  • Medium max 6.5
    USN-4056-1 7 CVEs

    exiv2 vulnerabilities

    It was discovered that Exiv2 incorrectly handled certain PSD files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19107, CVE-2018-19108) It was discovered that Exiv2 incorrectly handled certain PNG files. An attacker could …

    first Jul 15, 2019
  • Medium max 4.8
    USN-4097-2 2 CVEs

    php5 vulnerabilities

    USN-4097-1 fixed several vulnerabilities in php5. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain images. An attacker could possibly use…

    first Aug 13, 2019
  • Unscored
    USN-4057-1 1 CVE

    Zipios vulnerability

    Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An attacker could use this vulnerability to cause a denial of service or consume system resources. (CVE-2019-13453)

    first Jul 15, 2019
  • Medium max 6.5
    USN-4052-1 1 CVE

    whoopsie vulnerability

    Kevin Backhouse discovered Whoopsie incorrectly handled very large crash reports. A local attacker could possibly use this issue to cause a denial of service or expose sensitive information.

    first Jul 9, 2019
  • Unscored
    USN-4091-1 1 CVE

    poppler vulnerability

    It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a denial of service.

    first Aug 12, 2019
  • Unscored
    USN-4049-2 1 CVE

    glib2.0 vulnerability

    USN-4049-1 fixed a vulnerability in GLib. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that GLib created directories and files without properly restricting permissions. A…

    first Jul 8, 2019
  • Unscored
    USN-4046-1 2 CVEs

    irssi vulnerabilities

    It was discovered that Irssi incorrectly handled certain disconnections. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-7054) It was discovered that Irssi …

    first Jul 4, 2019
  • Unscored
    USN-4075-1 1 CVE

    exim4 vulnerability

    Jeremy Harris discovered that Exim incorrectly handled sort expansions. In environments where sort expansions are used, a remote attacker could possibly use this issue to execute arbitrary code as root.

    first Jul 25, 2019
  • Unscored
    USN-4078-2 2 CVEs

    openldap vulnerabilities

    USN-4078-1 fixed several vulnerabilities in openldap. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that OpenLDAP incorrectly handled rootDN delegation. A database adminis…

    first Aug 19, 2019
  • Unscored
    USN-4049-4 0 CVEs

    glib2.0 regression

    USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib created directories and files without properly restricting …

    first Aug 6, 2019
  • Unscored
    USN-4049-3 0 CVEs

    glib2.0 regression

    USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression in Ubuntu 16.04 LTS causing a possibly memory leak. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib created …

    first Aug 5, 2019
  • Critical max 10.0
    USN-4045-1 2 CVEs 2 exploited

    thunderbird vulnerabilities

    A type confusion bug was discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could exploit this by causing a denial of service, or executing arbirary code. (CVE-2019-11707) It was disc…

    first Jul 1, 2019
  • Medium max 5.3
    USN-4041-1 1 CVE

    linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon update

    USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. Unfortunately, the update introduced a regression that interfered with networking applications that setup very low SO_SNDBUF values. This update fixes the problem. We apologize for the inconveni…

    first Jun 29, 2019
  • Unscored
    USN-4063-1 2 CVEs

    libreoffice vulnerabilities

    Nils Emmerich discovered that LibreOffice incorrectly handled LibreLogo scripts. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to execute arbitrary code. (CVE-2019-9848) Matei "Mal" Badanoiu discov…

    first Jul 17, 2019
  • Critical max 9.8
    USN-4038-2 2 CVEs

    bzip2 vulnerabilities

    USN-4038-1 fixed several vulnerabilities in bzip2. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could p…

    first Jun 26, 2019
  • Unscored
    USN-4038-4 0 CVEs

    bzip2 regression

    USN-4038-1 fixed a vulnerability in bzip2. The update introduced a regression causing bzip2 to incorrect raises CRC errors for some files. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM. We apologize for the inconvenience. Or…

    first Jul 4, 2019
  • Unscored
    USN-4038-3 0 CVEs

    bzip2 regression

    USN-4038-1 fixed a vulnerability in bzip2. The update introduced a regression causing bzip2 to incorrect raises CRC errors for some files. We apologize for the inconvenience. Original advisory details: It was discovered that bzip2 incorrectly handled certain …

    first Jul 4, 2019
  • Unscored
    USN-4044-1 1 CVE

    znc vulnerability

    Fix vulnerability where an authenticated non-admin users could load a module with a crafted name, then escalate privileges and run arbitrary code.

    first Jul 1, 2019
  • Unscored
    USN-4049-1 1 CVE

    glib2.0 vulnerability

    It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibly use this issue to access sensitive information.

    first Jul 8, 2019
  • High max 8.8
    USN-4047-1 3 CVEs

    libvirt vulnerabilities

    Matthias Gerstner and Ján Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to check for arbitrary files, or execute arbitrary binaries. In the default installation, attackers would be isolated by t…

    first Jul 8, 2019
  • High max 7.5
    USN-4035-1 4 CVEs

    ceph vulnerabilities

    It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662) It was discovered that Ceph incorrectly handl…

    first Jun 25, 2019
  • High max 7.5
    USN-4027-1 1 CVE

    postgresql-10, postgresql-11 vulnerability

    Alexander Lakhin discovered that PostgreSQL incorrectly handled authentication. An authenticated attacker or a rogue server could use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. The default co…

    first Jun 20, 2019
  • Medium max 5.9
    USN-4026-1 1 CVE

    bind9 vulnerability

    It was discovered that Bind incorrectly handled certain malformed packets. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.

    first Jun 20, 2019
  • High max 7.1
    USN-4015-2 1 CVE

    dbus vulnerability

    USN-4015-1 fixed a vulnerability in DBus. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Joe Vennix discovered that DBus incorrectly handled DBUS_COOKIE_SHA1 authentication. A local attacker…

    first Jun 12, 2019
  • Critical max 10.0
    USN-4032-1 1 CVE 1 exploited

    firefox vulnerability

    It was discovered that a sandboxed child process could open arbitrary web content in the parent process via the Prompt:Open IPC message. When combined with another vulnerability, an attacker could potentially exploit this to execute arbitrary code.

    first Jun 24, 2019
  • High max 8.8
    USN-4020-1 1 CVE 1 exploited

    firefox vulnerability

    A type confusion bug was discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this by causing a denial of service, or executing arbitrary code.

    first Jun 19, 2019
  • High max 7.1
    USN-4015-1 1 CVE

    dbus vulnerability

    Joe Vennix discovered that DBus incorrectly handled DBUS_COOKIE_SHA1 authentication. A local attacker could possibly use this issue to bypass authentication and connect to DBus servers with elevated privileges.

    first Jun 11, 2019
  • Unscored
    USN-4042-1 12 CVEs

    poppler vulnerabilities

    It was discovered that poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service, or possibly execute arbitrary code

    first Jun 27, 2019
  • Unscored
    USN-4008-2 1 CVE

    apparmor update

    USN-4008-1 fixed multiple security issues in the Linux kernel. This update provides the corresponding changes to AppArmor policy for correctly operating under the Linux kernel with fixes for CVE-2019-11190. Without these changes, some profile transitions may …

    first Jun 5, 2019
  • High max 7.5
    USN-4017-1 2 CVEs

    linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

    Jonathan Looney discovered that the TCP retransmission queue implementation in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (CVE-2019-1…

    first Jun 17, 2019
  • Critical max 9.0
    USN-4010-1 1 CVE 1 exploited

    exim4 vulnerability

    It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands.

    first Jun 5, 2019
  • Unscored
    USN-4024-1 0 CVEs

    evince update

    As a security improvement, this update adjusts the AppArmor profile for the Evince thumbnailer to reduce access to the system and adjusts the AppArmor profile for Evince and Evince previewer to limit access to the DBus system bus. Additionally adjust the evin…

    first Jun 19, 2019
  • Critical max 9.8
    USN-4038-1 2 CVEs

    bzip2 vulnerabilities

    Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3189) It was discovered that bzip2 incorrectly handled certai…

    first Jun 26, 2019
  • Unscored
    USN-4028-1 4 CVEs

    thunderbird vulnerabilities

    Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code.

    first Jun 20, 2019
  • Medium max 4.8
    USN-4009-1 3 CVEs

    php7.0, php7.2 vulnerabilities

    It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11036) It was discovered that PHP i…

    first Jun 5, 2019
  • Unscored
    USN-4050-1 1 CVE

    zeromq3 vulnerability

    It was discovered that ZeroMQ incorrectly handled certain application metadata. A remote attacker could use this issue to cause ZeroMQ to crash, or possibly execute arbitrary code.

    first Jul 8, 2019
  • High max 7.5
    USN-4017-2 2 CVEs

    linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities

    USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. This update provides the corresponding updates for the Linux kernel for Ubuntu 16.04 ESM and Ubuntu 14.04 ESM. Jonathan Looney discovered that the TCP retransmission queue implementation in the …

    first Jun 17, 2019