Ubuntu Security Notices (USN)

8,464 results · Feed

• High max 7.5
  USN-3765-1 1 CVE

  curl vulnerability

  It was discovered that curl incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code.

  Apr 22, 2026

  first Sep 17, 2018
• Unscored
  USN-3728-1 4 CVEs

  libmspack vulnerabilities

  Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14679, CVE-2018-14680) Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. A…

  Apr 22, 2026

  first Aug 1, 2018
• Unscored
  USN-3730-1 1 CVE

  lxc vulnerability

  Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could possibly use this issue to open arbitrary files.

  Apr 22, 2026

  first Aug 6, 2018
• Unscored
  USN-3743-1 14 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

  Apr 22, 2026

  first Aug 16, 2018
• Unscored
  USN-3766-1 3 CVEs

  php5, php7.0, php7.2 vulnerabilities

  It was discovered that PHP incorrectly handled restarting certain child processes when php-fpm is used. A remote attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2015-9253) It was dis…

  Apr 22, 2026

  first Sep 18, 2018
• Unscored
  USN-3718-1 0 CVEs

  linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem regression

  USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. Unfortunately, the fix for CVE-2018-1108 introduced a regression where insufficient early entropy prevented services from starting, leading in some situations to a failure to boot, Thi…

  Apr 22, 2026

  first Jul 21, 2018
• High max 7.3
  USN-3753-1 11 CVEs

  linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

  It was discovered that the generic SCSI driver in the Linux kernel did not properly enforce permissions on kernel memory access. A local attacker could use this to expose sensitive information or possibly elevate privileges. (CVE-2017-13168) Wen Xu discovered…

  Apr 22, 2026

  first Aug 24, 2018
• High max 7.5
  USN-3739-1 5 CVEs

  libxml2 vulnerabilities

  Matias Brutti discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2016-9318) It was discovered that libxml2 incorrectly handled certain files. An attacker could possibl…

  Apr 22, 2026

  first Aug 14, 2018
• Unscored
  USN-3722-5 0 CVEs

  clamav regression

  USN-3722-1 fixed vulnerabilities in ClamAV. The new package introduced an issue which caused dpkg-reconfigure to enter an infinite loop. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that ClamA…

  Apr 22, 2026

  first Sep 18, 2018
• Unscored
  USN-3722-3 0 CVEs

  clamav regression

  USN-3722-1 fixed vulnerabilities in ClamAV. The updated ClamAV version removed some configuration options which caused the daemon to fail to start in environments where the ClamAV configuration file was manually edited. This update fixes the problem. We apolo…

  Apr 22, 2026

  first Jul 26, 2018
• Unscored
  USN-3736-1 6 CVEs

  libarchive vulnerabilities

  It was discovered that libarchive incorrectly handled certain archive files. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10209, CVE-2016-10349, CVE-201…

  Apr 22, 2026

  first Aug 13, 2018
• Unscored
  USN-3714-1 11 CVEs

  thunderbird vulnerabilities

  Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass CORS restrictions, obtain sensiti…

  Apr 22, 2026

  first Jul 12, 2018
• Medium max 4.7
  USN-3717-1 4 CVEs

  policykit-1 vulnerabilities

  Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid object paths. A local attacker could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3218) …

  Apr 22, 2026

  first Jul 16, 2018
• Medium max 6.1
  USN-3709-1 1 CVE

  xapian-core vulnerability

  It was discovered that Xapian-core incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code.

  Apr 22, 2026

  first Jul 10, 2018
• Unscored
  USN-3732-1 1 CVE

  linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerability

  Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packets. A remote attacker could use this to cause a denial of service.

  Apr 22, 2026

  first Aug 6, 2018
• Unscored
  USN-3710-1 1 CVE

  curl vulnerability

  Peter Wu discovered that curl incorrectly handled certain SMTP buffers. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jul 11, 2018
• Unscored
  USN-3741-3 0 CVEs

  linux regressions

  USN-3741-1 introduced mitigations in the Linux kernel for Ubuntu 14.04 LTS to address L1 Terminal Fault (L1TF) vulnerabilities (CVE-2018-3620, CVE-2018-3646). Unfortunately, the update introduced regressions that caused kernel panics when booting in some envi…

  Apr 22, 2026

  first Aug 17, 2018
• Unscored
  USN-3729-1 1 CVE

  libxcursor vulnerability

  It was discovered that libxcursor incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.

  Apr 22, 2026

  first Aug 6, 2018
• Unscored
  USN-3711-1 3 CVEs

  imagemagick vulnerabilities

  It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

  Apr 22, 2026

  first Jul 11, 2018
• Unscored
  USN-3708-1 2 CVEs

  openslp-dfsg vulnerabilities

  It was discovered that OpenSLP incorrectly handled certain memory operations. A remote attacker could use this issue to cause OpenSLP to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jul 9, 2018
• Medium max 5.4
  USN-3738-1 4 CVEs

  samba vulnerabilities

  Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-10858)…

  Apr 22, 2026

  first Aug 14, 2018
• Unscored
  USN-3702-2 1 CVE

  php7.2 vulnerability

  USN-3702-1 fixed a vulnerability in PHP. PHP 7.2.7 did not actually include the fix for CVE-2018-12882. This update adds a backported patch to correct the issue. We apologize for the inconvenience. Original advisory details: It was discovered that PHP incorre…

  Apr 22, 2026

  first Jul 5, 2018
• Unscored
  USN-3728-2 4 CVEs

  clamav vulnerabilities

  USN-3728-1 fixed several vulnerabilities in libmspack. In Ubuntu 14.04 libmspack is included into ClamAV. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: Hanno Böck discovered that libmspack incorrectly handled c…

  Apr 22, 2026

  first Aug 1, 2018
• Unscored
  USN-3722-1 2 CVEs

  clamav vulnerabilities

  It was discovered that ClamAV incorrectly handled parsing certain HWP files. A remote attacker could use this issue to cause ClamAV to hang, resulting in a denial of service. (CVE-2018-0360) It was discovered that ClamAV incorrectly handled parsing certain PD…

  Apr 22, 2026

  first Jul 24, 2018
• Unscored
  USN-3724-1 1 CVE

  evolution-data-server vulnerability

  Jon Kristensen discovered that Evolution Data Server would automatically downgrade a connection to an IMAP server if the IMAP server did not support SSL. This would result in the user's password being unexpectedly sent in clear text, even though the user had …

  Apr 22, 2026

  first Jul 26, 2018
• Unscored
  USN-3702-1 1 CVE

  php7.2 vulnerability

  It was discovered that PHP incorrectly handled exif tags in certain images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jul 4, 2018
• Unscored
  USN-3705-2 0 CVEs

  firefox regressions

  USN-3705-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tr…

  Apr 22, 2026

  first Jul 10, 2018
• Unscored
  USN-3914-1 1 CVE

  ntfs-3g vulnerability

  A heap buffer overflow was discovered in NTFS-3G when executing it with a relative mount point path that is too long. A local attacker could potentially exploit this to execute arbitrary code as the administrator.

  Apr 22, 2026

  first Mar 21, 2019
• Unscored
  USN-3705-1 17 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, bypass same-origin restrictions, bypass…

  Apr 22, 2026

  first Jul 5, 2018
• Unscored
  USN-3699-1 7 CVEs

  zziplib vulnerabilities

  It was discovered that zziplib incorrectly handled certain malformed ZIP files. If a user or automated system were tricked into opening a specially crafted ZIP file, a remote attacker could cause zziplib to crash, resulting in a denial of service, or possibly…

  Apr 22, 2026

  first Jul 3, 2018
• Unscored
  USN-3696-1 10 CVEs

  linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

  It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18255) Wei Fang discovered an integer overflow in the F2FS filesystem implemen…

  Apr 22, 2026

  first Jul 2, 2018
• Unscored
  USN-3701-1 1 CVE

  libsoup2.4 vulnerability

  It was discovered that libsoup incorrectly handled certain cookie requests. An attacker could possibly use this to cause a denial of service.

  Apr 22, 2026

  first Jul 3, 2018
• High max 8.8
  USN-3687-1 7 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

  Apr 22, 2026

  first Jun 18, 2018
• Medium max 5.5
  USN-3698-1 10 CVEs

  linux vulnerabilities

  It was discovered that the nested KVM implementation in the Linux kernel in some situations did not properly prevent second level guests from reading and writing the hardware CR8 register. A local attacker in a guest could use this to cause a denial of servic…

  Apr 22, 2026

  first Jul 2, 2018
• Unscored
  USN-3678-1 3 CVEs

  linux, linux-aws, linux-gcp, linux-kvm vulnerabilities

  Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem that caused a denial of service (system crash) when …

  Apr 22, 2026

  first Jun 12, 2018
• Unscored
  USN-3681-1 124 CVEs

  imagemagick vulnerabilities

  It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

  Apr 22, 2026

  first Jun 12, 2018
• Unscored
  USN-3693-1 18 CVEs

  jasper vulnerabilities

  It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

  Apr 22, 2026

  first Jun 27, 2018
• Unscored
  USN-3673-1 1 CVE

  unbound vulnerability

  Ralph Dolmans and Karst Koymans discovered that Unbound did not properly handle certain NSEC records. An attacker could use this to to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick Unbound into accepting a NODATA proof.

  Apr 22, 2026

  first Jun 7, 2018
• Unscored
  USN-3676-1 4 CVEs

  linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

  Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem that caused a denial of service (system crash) when …

  Apr 22, 2026

  first Jun 11, 2018
• Unscored
  USN-3700-1 6 CVEs

  exiv2 vulnerabilities

  It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2018-10958, CVE-2018-10998) It was discovered that Exiv2 incorrectly handled certain PNG files. An attacker could possibly u…

  Apr 22, 2026

  first Jul 3, 2018