Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,464 results · Feed

  • Unscored
    USN-3863-1 1 CVE

    apt vulnerability

    Max Justicz discovered that APT incorrectly handled certain parameters during redirects. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages.

    first Jan 22, 2019
  • High max 7.5
    USN-3956-1 1 CVE

    bind9 vulnerability

    It was discovered that Bind incorrectly handled limiting the number of simultaneous TCP clients. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service.

    first Apr 25, 2019
  • Unscored
    USN-3922-1 5 CVEs

    php7.0, php7.2 vulnerabilities

    It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2019-9637, CVE-2019-9638, CVE-2019-9639, CVE-2019-9640, CVE-2019-9641)

    first Mar 26, 2019
  • High max 7.8
    USN-3937-1 6 CVEs 1 exploited

    apache2 vulnerabilities

    Charles Fol discovered that the Apache HTTP Server incorrectly handled the scoreboard shared memory area. A remote attacker able to upload and run scripts could possibly use this issue to execute arbitrary code with root privileges. (CVE-2019-0211) It was dis…

    first Apr 4, 2019
  • Unscored
    USN-3901-1 3 CVEs

    linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2 vulnerabilities

    Jann Horn discovered that the userfaultd implementation in the Linux kernel did not properly restrict access to certain ioctls. A local attacker could use this possibly to modify files. (CVE-2018-18397) It was discovered that the crypto subsystem of the Linux…

    first Mar 5, 2019
  • Unscored
    USN-3927-1 10 CVEs

    thunderbird vulnerabilities

    It was discovered that Thunderbird allowed PAC files to specify that requests to localhost are sent through the proxy to another server. If proxy auto-detection is enabled, an attacker could potentially exploit this to conduct attacks on local services and to…

    first Mar 28, 2019
  • Medium max 4.8
    USN-3953-1 2 CVEs

    php7.0, php7.2 vulnerabilities

    It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Apr 23, 2019
  • High max 8.8
    USN-3948-1 14 CVEs 1 exploited

    webkit2gtk vulnerabilities

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

    first Apr 16, 2019
  • High max 7.5
    USN-3940-1 3 CVEs

    clamav vulnerabilities

    It was discovered that ClamAV incorrectly handled scanning certain PDF documents. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2019-1787) It was discovered that ClamAV incorrectly handled sca…

    first Apr 8, 2019
  • Unscored
    USN-3925-1 1 CVE

    freeimage vulnerability

    It was discovered that an out-of-bounds write vulnerability existed in the XMP image handling functionality of the FreeImage library. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could overwrite arbitrar…

    first Mar 28, 2019
  • Unscored
    USN-3918-2 17 CVEs

    firefox vulnerabilities

    USN-3918-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubuntu 14.04 LTS. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website,…

    first Mar 25, 2019
  • High max 7.3
    USN-3915-1 2 CVEs

    ghostscript vulnerabilities

    It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to access arbitrary files, execute arbitrary …

    first Mar 21, 2019
  • Unscored
    USN-3921-1 1 CVE

    xmltooling vulnerability

    It was discovered that XMLTooling incorrectly handled certain XML files with invalid data. An attacker could use this issue to cause XMLTooling to crash, resulting in a denial of service.

    first Mar 26, 2019
  • Unscored
    USN-3862-1 1 CVE

    irssi vulnerability

    It was discovered that Irssi incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or to execute arbitrary code.

    first Jan 17, 2019
  • Unscored
    USN-3918-3 0 CVEs

    firefox regression

    USN-3918-1 fixed vulnerabilities in Firefox. The update caused web compatibility issues with some websites. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a…

    first Mar 28, 2019
  • Unscored
    USN-3914-2 0 CVEs

    ntfs-3g update

    USN-3914-1 fixed vulnerabilities in NTFS-3G. As an additional hardening measure, this update removes the setuid bit from the ntfs-3g binary. Original advisory details: A heap buffer overflow was discovered in NTFS-3G when executing it with a relative mount po…

    first Apr 17, 2019
  • Medium max 4.2
    USN-3939-1 1 CVE

    samba vulnerability

    Michael Hanselmann discovered that Samba incorrectly handled registry files. A remote attacker could possibly use this issue to create new registry files outside of the share, contrary to expectations.

    first Apr 8, 2019
  • Medium max 5.8
    USN-3909-1 1 CVE

    libvirt vulnerability

    It was discovered that libvirt incorrectly handled waiting for certain agent events. An attacker inside a guest could possibly use this issue to cause libvirtd to stop responding, resulting in a denial of service.

    first Mar 14, 2019
  • Unscored
    USN-3918-1 17 CVEs

    firefox vulnerabilities

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, denial of service via successive FTP authori…

    first Mar 21, 2019
  • Unscored
    USN-3911-1 3 CVEs

    file vulnerabilities

    It was discovered that file incorrectly handled certain malformed ELF files. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.

    first Mar 18, 2019
  • Unscored
    USN-3870-1 1 CVE

    spice vulnerability

    Christophe Fergeau discovered that Spice incorrectly handled memory. A remote attacker could use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jan 28, 2019
  • Unscored
    USN-3904-1 1 CVE

    nvidia-graphics-drivers-390 vulnerability

    It was discovered that the NVIDIA graphics drivers incorrectly handled the GPU performance counters. A local attacker could possibly use this issue to access the application data processed on the GPU.

    first Mar 7, 2019
  • Unscored
    USN-3866-2 0 CVEs

    ghostscript regression

    USN-3866-1 fixed vulnerabilities in Ghostscript. The new Ghostscript version introduced a regression when printing certain page sizes. This update fixes the problem. Original advisory details: Tavis Ormandy discovered that Ghostscript incorrectly handled cert…

    first Feb 21, 2019
  • Medium max 4.5
    USN-3856-1 1 CVE

    gnome-bluetooth vulnerability

    Chris Marchesi discovered that BlueZ incorrectly handled disabling Bluetooth visibility. A remote attacker could possibly pair to devices, contrary to expectations. This update adds a workaround to GNOME Bluetooth to fix the issue.

    first Jan 14, 2019
  • Unscored
    USN-3905-1 1 CVE

    poppler vulnerability

    It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a denial of service.

    first Mar 11, 2019
  • Unscored
    USN-3898-1 1 CVE

    nss vulnerability

    Hanno Böck and Damian Poddebniak discovered that NSS incorrectly handled certain CMS functions. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service.

    first Feb 27, 2019
  • Unscored
    USN-3919-1 2 CVEs

    firefox vulnerabilities

    Two security issues were discovered in the JavaScript engine in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this by causing a denial of service, or executing arbitrary code.

    first Mar 25, 2019
  • Unscored
    USN-3861-1 1 CVE

    policykit-1 vulnerability

    It was discovered that PolicyKit incorrectly handled certain large user UIDs. A local attacker with a large UID could possibly use this issue to perform privileged actions.

    first Jan 16, 2019
  • Unscored
    USN-3868-1 10 CVEs

    thunderbird vulnerabilities

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass same-origin restrictions, or exec…

    first Jan 24, 2019
  • Unscored
    USN-3908-1 1 CVE

    linux vulnerability

    Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker could use this to gain access to services that cache authorizations.

    first Mar 12, 2019
  • High max 7.8
    USN-3883-1 5 CVEs

    libreoffice vulnerabilities

    It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2018-10119, CVE-2018…

    first Feb 6, 2019
  • Unscored
    USN-3922-2 7 CVEs

    php5 vulnerabilities

    USN-3922-1 fixed vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 LTS. It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2019-902…

    first Apr 23, 2019
  • Unscored
    USN-3918-4 0 CVEs

    firefox regressions

    USN-3918-1 fixed vulnerabilities in Firefox. The update caused web compatibility and performance issues with some websites. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered …

    first Apr 16, 2019
  • Unscored
    USN-3886-1 2 CVEs

    poppler vulnerabilities

    It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-20551, CVE-2019-7310)

    first Feb 11, 2019
  • Unscored
    USN-3902-1 5 CVEs

    php5, php7.0 vulnerabilities

    It was discovered that the PHP XML-RPC module incorrectly handled decoding XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-9020, CVE-2019-9024) It was discovered that the PHP PHAR mo…

    first Mar 6, 2019
  • Unscored
    USN-3899-1 1 CVE

    openssl, openssl1.0 vulnerability

    Juraj Somorovsky, Robert Merget, and Nimrod Aviram discovered that certain applications incorrectly used OpenSSL and could be exposed to a padding oracle attack. A remote attacker could possibly use this issue to decrypt data.

    first Feb 27, 2019
  • High max 7.3
    USN-3871-1 13 CVEs

    linux vulnerabilities

    Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possi…

    first Jan 29, 2019
  • Unscored
    USN-3895-1 1 CVE

    ldb vulnerability

    It was discovered that LDB incorrectly handled certain search expressions. A remote attacker could possibly use this issue to cause the Samba LDAP process to crash, resulting in a denial of service.

    first Feb 26, 2019
  • Unscored
    USN-3864-1 7 CVEs

    tiff vulnerabilities

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute …

    first Jan 22, 2019
  • Unscored
    USN-3912-1 1 CVE

    gdk-pixbuf vulnerability

    It was discovered that the GDK-PixBuf library did not properly handle certain BMP images. If an user or automated system were tricked into opening a specially crafted BMP file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a…

    first Mar 20, 2019