Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,464 results · Feed

  • Medium max 4.8
    USN-4009-2 2 CVEs

    php5 vulnerabilities

    USN-4009-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly decoding certain MIME headers. A remote attacker could …

    first Jun 5, 2019
  • Unscored
    USN-4014-2 1 CVE

    glib2.0 vulnerability

    USN-4014-1 fixed a vulnerability in GLib. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that GLib incorrectly handled certain files. An attacker could possibly use this is…

    first Jun 11, 2019
  • Unscored
    USN-4102-1 3 CVEs

    libreoffice vulnerabilities

    It was discovered that LibreOffice incorrectly handled LibreLogo scripts. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to execute arbitrary code. (CVE-2019-9850, CVE-2019-9851) It was discovered t…

    first Aug 19, 2019
  • High max 8.8
    USN-4047-2 1 CVE

    libvirt vulnerability

    USN-4047-1 fixed a vulnerability in libvirt. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Matthias Gerstner and Ján Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possib…

    first Jan 13, 2020
  • High max 7.5
    USN-4000-1 1 CVE

    corosync vulnerability

    It was discovered that Corosync incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

    first May 30, 2019
  • Unscored
    USN-4007-1 1 CVE

    linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerability

    Federico Manuel Bento discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid a.out binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerabilit…

    first Jun 4, 2019
  • Unscored
    USN-4033-1 1 CVE

    libmysofa vulnerability

    It was discovered that a libmysofa component does not properly validate multiplications and additions, and may crash with some specific input.

    first Jun 24, 2019
  • Unscored
    USN-4014-1 1 CVE

    glib2.0 vulnerability

    It was discovered that GLib incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information.

    first Jun 10, 2019
  • Unscored
    USN-4001-2 1 CVE

    libseccomp vulnerability

    USN-4001-1 fixed a vulnerability in libseccomp. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Jann Horn discovered that libseccomp did not correctly generate 64-bit syscall argument comparisons with arithmetic …

    first May 30, 2019
  • Unscored
    USN-3992-1 3 CVEs

    webkit2gtk vulnerabilities

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

    first May 22, 2019
  • Low max 3.3
    USN-4013-1 13 CVEs

    libsndfile vulnerabilities

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jun 10, 2019
  • Unscored
    USN-4012-1 9 CVEs

    elfutils vulnerabilities

    It was discovered that elfutils incorrectly handled certain malformed files. If a user or automated system were tricked into processing a specially crafted file, elfutils could be made to crash or consume resources, resulting in a denial of service.

    first Jun 10, 2019
  • Unscored
    USN-3986-1 9 CVEs

    Wireshark vulnerabilities

    It was discovered that Wireshark improperly handled certain input. A remote or local attacker could cause Wireshark to crash by injecting malform packets onto the wire or convincing someone to read a malformed packet trace file.

    first May 16, 2019
  • Unscored
    USN-3988-1 2 CVEs

    libmediainfo vulnerabilities

    It was discovered that MediaInfoLib contained multiple security issues when handling certain multimedia files. If a user were tricked into opening a crafted multimedia file, an attacker could cause MediaInfoLib to crash, resulting in a denial of service.

    first May 16, 2019
  • Unscored
    USN-3991-2 0 CVEs

    firefox regression

    USN-3991-1 fixed vulnerabilities in Firefox. The update caused a regression which resulted in issues when upgrading between Ubuntu releases. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues…

    first Jun 6, 2019
  • Unscored
    USN-4003-1 3 CVEs

    qtbase-opensource-src vulnerabilities

    It was discovered that Qt incorrectly handled certain XML documents. A remote attacker could use this issue with a specially crafted XML document to cause Qt to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-15518) It w…

    first Jun 3, 2019
  • Unscored
    USN-3976-4 0 CVEs

    samba vulnerability

    USN-3976-1 fixed a vulnerability in Samba. The update introduced a regression causing Samba to occasionally crash. This update fixes the problem. Original advisory details: Isaac Boukris and Andrew Bartlett discovered that Samba incorrectly checked S4U2Self p…

    first May 27, 2019
  • High max 7.5
    USN-3976-2 1 CVE

    samba vulnerability

    USN-3976-1 fixed a vulnerability in Samba. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Isaac Boukris and Andrew Bartlett discovered that Samba incorrectly checked S4U2Self packets. In cer…

    first May 14, 2019
  • Unscored
    USN-3960-1 1 CVE

    wavpack vulnerability

    It was discovered that WavPack incorrectly handled certain DFF files. An attacker could possibly use this issue to cause a denial of service.

    first Apr 30, 2019
  • High max 7.3
    USN-3970-1 1 CVE

    ghostscript vulnerability

    It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to access arbitrary files, execute arbitrary …

    first May 8, 2019
  • Unscored
    USN-4001-1 1 CVE

    libseccomp vulnerability

    Jann Horn discovered that libseccomp did not correctly generate 64-bit syscall argument comparisons with arithmetic operators (LT, GT, LE, GE). An attacker could use this to bypass intended access restrictions for argument-filtered system calls.

    first May 30, 2019
  • Unscored
    USN-3994-1 1 CVE

    gnome-desktop3 vulnerability

    It was discovered that gnome-desktop incorrectly confined thumbnailers. If a user were tricked into downloading a malicious image file, a remote attacker could possibly combine this issue with another vulnerability to escape the sandbox and execute arbitrary …

    first May 27, 2019
  • Unscored
    USN-3967-1 4 CVEs

    FFmpeg vulnerabilities

    It was discovered that FFmpeg contained multiple security issues when handling certain multimedia files. If a user were tricked into opening a crafted multimedia file, an attacker could cause a denial of service via application crash.

    first May 6, 2019
  • Unscored
    USN-3958-1 1 CVE

    gst-plugins-base0.10, gst-plugins-base1.0 vulnerability

    It was discovered that GStreamer Base Plugins did not correctly handle certain malformed RTSP streams. If a user were tricked into opening a crafted RTSP stream with a GStreamer application, an attacker could cause a denial of service via application crash, o…

    first Apr 29, 2019
  • High max 8.8
    USN-3952-1 3 CVEs

    pacemaker vulnerabilities

    Jan Pokorný discovered that Pacemaker incorrectly handled client-server authentication. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-16877) Jan Pokorný discovered that Pacemaker incorrectly handled certain verifications. A …

    first Apr 23, 2019
  • Unscored
    USN-3991-3 0 CVEs

    firefox regression

    USN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a subsequent regression. The update caused an additional regression that resulted in Firefox failing to load correctly after executing it in safe mode. This update fixes the problem. We apologi…

    first Jun 14, 2019
  • High max 7.5
    USN-3976-1 1 CVE

    samba vulnerability

    Isaac Boukris and Andrew Bartlett discovered that Samba incorrectly checked S4U2Self packets. In certain environments, a remote attacker could possibly use this issue to escalate privileges.

    first May 14, 2019
  • Medium max 4.8
    USN-3953-2 2 CVEs

    php5 vulnerabilities

    USN-3953-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote atta…

    first May 1, 2019
  • High max 7.5
    USN-3956-2 1 CVE

    bind9 vulnerability

    USN-3956-1 fixed a vulnerability in Bind. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Bind incorrectly handled limiting the number of simultaneous TCP clients. A re…

    first May 9, 2019
  • Unscored
    USN-3954-1 2 CVEs

    freeradius vulnerabilities

    It was discovered that FreeRADIUS incorrectly handled certain inputs. An attacker could possibly use this issue to bypass authentication. (CVE-2019-11234, CVE-2019-11235)

    first Apr 24, 2019
  • Unscored
    USN-3933-1 8 CVEs

    linux vulnerabilities

    It was discovered that an information leak vulnerability existed in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could possibly expose sensitive information (kernel memory). (CVE-2017-1000410) It was discovered that the…

    first Apr 2, 2019
  • Medium max 4.5
    USN-3938-1 1 CVE

    systemd vulnerability

    Jann Horn discovered that pam_systemd created logind sessions using some parameters from the environment. A local attacker could exploit this in order to spoof the active session and gain additional PolicyKit privileges.

    first Apr 8, 2019
  • Medium max 6.5
    USN-3973-1 1 CVE

    isc-dhcp vulnerability

    It was discovered that DHCP, when built with a mismatched external BIND library, incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause DHCP to crash, resulting in a denial of service.

    first May 13, 2019
  • Unscored
    USN-3976-3 0 CVEs

    samba regression

    USN-3976-1 fixed a vulnerability in Samba. The update introduced a regression causing Samba to occasionally crash. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Isaac Boukris and Andrew Bartlett discovered that …

    first May 27, 2019
  • Low max 3.1
    USN-3972-1 1 CVE

    postgresql-10, postgresql-11, postgresql-9.5 vulnerabilities

    It was discovered that PostgreSQL incorrectly handled partition routing. A remote user could possibly use this issue to read arbitrary bytes of server memory. This issue only affected Ubuntu 19.04. (CVE-2019-10129) Dean Rasheed discovered that PostgreSQL inco…

    first May 13, 2019
  • Unscored
    USN-3941-1 1 CVE

    lua5.3 vulnerability

    Fady Othman discovered that Lua incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service.

    first Apr 8, 2019
  • High max 7.5
    USN-3893-1 3 CVEs

    bind9 vulnerabilities

    Toshifumi Sakaguchi discovered that Bind incorrectly handled memory. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-5744…

    first Feb 22, 2019
  • Unscored
    USN-3929-1 2 CVEs

    firebird2.5 vulnerabilities

    It was discovered that Firebird incorrectly handled certain malformed packets. A remote attacker could possibly use this issue with a specially crafted network packet to cause Firebird to crash, resulting in a denial of service. (CVE-2014-9323) It was discove…

    first Apr 2, 2019
  • High max 8.8
    USN-3928-1 1 CVE

    dovecot vulnerability

    It was discovered that Dovecot incorrectly handled reading certain headers from the index. A local attacker could possibly use this issue to escalate privileges.

    first Apr 1, 2019
  • Unscored
    USN-3934-1 1 CVE

    policykit-1 vulnerability

    It was discovered that PolicyKit incorrectly relied on the fork() system call in the Linux kernel being atomic. A local attacker could possibly use this issue to gain access to services that have cached authorizations.

    first Apr 3, 2019