Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,464 results · Feed

  • Unscored
    USN-3682-1 1 CVE

    firefox vulnerability

    A heap buffer overflow was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code.

    first Jun 12, 2018
  • Unscored
    USN-3695-1 5 CVEs

    linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly initialize the crc32c checksum driver. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-1094) It was discovered that the cdrom…

    first Jul 2, 2018
  • Unscored
    USN-3684-1 1 CVE

    perl vulnerability

    It was discovered that Perl incorrectly handled certain archive files. An attacker could possibly use this to overwrite arbitrary files.

    first Jun 13, 2018
  • Unscored
    USN-3670-1 9 CVEs

    elfutils vulnerabilities

    Agostino Sarubbo discovered that elfutils incorrectly handled certain malformed ELF files. If a user or automated system were tricked into processing a specially crafted ELF file, elfutils could be made to crash or consume resources, resulting in a denial of …

    first Jun 5, 2018
  • Unscored
    USN-3692-1 3 CVEs

    openssl, openssl1.0 vulnerabilities

    Keegan Ryan discovered that OpenSSL incorrectly handled ECDSA key generation. An attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys. (CVE-2018-0495) Guido Vranken discovered that OpenSSL incorrectly handled …

    first Jun 26, 2018
  • Unscored
    USN-3688-1 5 CVEs

    mozjs52 vulnerabilities

    Multiple memory safety issues were fixed in Spidermonkey. An attacker could potentially exploit these to cause a denial of service, or execute arbitrary code.

    first Jun 19, 2018
  • Unscored
    USN-3669-1 3 CVEs

    liblouis vulnerabilities

    It was discovered that Liblouis incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11410) It was discovered that Liblouis incorrectly handled certain files.…

    first Jun 4, 2018
  • Medium max 5.3
    USN-3683-1 1 CVE

    bind9 vulnerability

    Andrew Skalski discovered that Bind could incorrectly enable recursion when the "allow-recursion" setting wasn't specified. This issue could improperly permit recursion to all clients, contrary to expectations.

    first Jun 13, 2018
  • Unscored
    USN-3689-1 1 CVE

    libgcrypt11, libgcrypt20 vulnerability

    Keegan Ryan discovered that Libgcrypt was susceptible to a side-channel attack. A local attacker could possibly use this attack to recover ECDSA private keys.

    first Jun 19, 2018
  • High max 7.3
    USN-3658-1 5 CVEs

    procps vulnerabilities

    It was discovered that the procps-ng top utility incorrectly read its configuration file from the current working directory. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-1122) It was discovered that the procps-ng ps tool in…

    first May 23, 2018
  • Unscored
    USN-3674-1 4 CVEs

    linux vulnerabilities

    It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-1068) It was discovered th…

    first Jun 11, 2018
  • Unscored
    USN-3660-1 12 CVEs

    thunderbird vulnerabilities

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service via application crash, install lightweigh…

    first May 25, 2018
  • Unscored
    USN-3686-1 5 CVEs

    file vulnerabilities

    Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620) Alexander Cherepanov discovered that file incorrec…

    first Jun 14, 2018
  • Unscored
    USN-3647-1 2 CVEs

    poppler vulnerabilities

    It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this to cause a denial of service. (CVE-2017-18267) It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this …

    first May 15, 2018
  • Unscored
    USN-3645-2 0 CVEs

    firefox regression

    USN-3645-1 fixed vulnerabilities in Firefox. The update caused an issue where users experienced long UI pauses in some circumsances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were di…

    first May 18, 2018
  • Unscored
    USN-3662-1 2 CVEs

    nvidia-graphics-drivers-384 vulnerabilities

    It was discovered that the NVIDIA graphics drivers contained flaws in the kernel mode layer. A local attacker could use these issues to cause a denial of service or potentially escalate their privileges on the system.

    first May 29, 2018
  • Unscored
    USN-3668-1 8 CVEs

    exempi vulnerabilities

    It was discovered that Exempi incorrectly handled certain media files. If a user or automated system were tricked into opening a specially crafted file, a remote attacker could cause Exempi to hang or crash, resulting in a denial of service, or possibly execu…

    first Jun 4, 2018
  • Unscored
    USN-3672-1 3 CVEs

    liblouis vulnerabilities

    Henri Salo discovered that Liblouis incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. (CVE-2018-11683, CVE-2018-11684, CVE-2018-11685)

    first Jun 6, 2018
  • Unscored
    USN-3646-1 5 CVEs

    php5, php7.0, php7.1, php7.2 vulnerabilities

    It was discovered that PHP incorrectly handled opcache access controls when configured to use PHP-FPM. A local user could possibly use this issue to obtain sensitive information from another user's PHP applications. (CVE-2018-10545) It was discovered that the…

    first May 14, 2018
  • Medium max 5.5
    USN-3619-1 39 CVEs

    linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

    Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary cod…

    first Apr 4, 2018
  • High max 8.0
    USN-3641-1 3 CVEs

    linux, linux-aws, linux-azure, linux-euclid, linux-gcp, linux-hwe, linux-kvm, linux-lts-xenial, linux-oem, linux-raspi2, linux-snapdragon vulnerabilities

    Nick Peterson discovered that the Linux kernel did not properly handle debug exceptions following a MOV/POP to SS instruction. A local attacker could use this to cause a denial of service (system crash). This issue only affected the amd64 architecture. (CVE-2…

    first May 8, 2018
  • Unscored
    USN-3631-1 5 CVEs

    linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

    It was discovered that a buffer overread vulnerability existed in the keyring subsystem of the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2017-13305) It was discovered that the DM04/QQBOX USB d…

    first Apr 24, 2018
  • Unscored
    USN-3627-2 6 CVEs

    apache2 vulnerabilities

    USN-3627-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for Ubuntu 18.04 LTS. Original advisory details: Alex Nichols and Jakob Hirsch discovered that the Apache HTTP Server mod_authnz_ldap module incorrectly han…

    first Apr 30, 2018
  • Unscored
    USN-3636-1 2 CVEs

    ghostscript vulnerabilities

    It was discovered that Ghostscript incorrectly handled certain PostScript files. An attacker could possibly use this to cause a denial of server. (CVE-2016-10317) It was discovered that Ghostscript incorrectly handled certain PDF files. An attacker could poss…

    first Apr 30, 2018
  • High max 8.8
    USN-3645-1 24 CVEs

    firefox vulnerabilities

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cro…

    first May 11, 2018
  • Unscored
    USN-3628-1 1 CVE

    openssl vulnerability

    Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia discovered that OpenSSL incorrectly handled RSA key generation. An attacker could possibly use this issue to perform a cache-timing attack and recover private RSA keys.

    first Apr 19, 2018
  • Unscored
    USN-3638-1 14 CVEs

    qpdf vulnerabilities

    It was discovered that QPDF incorrectly handled certain malformed files. A remote attacker could use this issue to cause QPDF to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first May 7, 2018
  • Unscored
    USN-3589-1 1 CVE

    postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerability

    It was discovered that PostgreSQL incorrectly handled certain settings. An attacker could possibly use this issue to execute arbitrary code.

    first Mar 6, 2018
  • Unscored
    USN-3627-1 6 CVEs

    apache2 vulnerabilities

    Alex Nichols and Jakob Hirsch discovered that the Apache HTTP Server mod_authnz_ldap module incorrectly handled missing charset encoding headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (…

    first Apr 19, 2018
  • Unscored
    USN-3640-1 1 CVE

    webkit2gtk vulnerability

    Ivan Fratric discovered that WebKitGTK+ incorrectly handled certain web content. If a user were tricked into viewing a malicious website, a remote attacker could possibly exploit this to execute arbitrary code.

    first May 8, 2018
  • Unscored
    USN-3600-1 3 CVEs

    php5, php7.0, php7.1 vulnerabilities

    It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-10712) It was discovered that PHP incorrectly handled the P…

    first Mar 19, 2018
  • Unscored
    USN-3620-1 8 CVEs

    linux vulnerabilities

    It was discovered that the netlink 802.11 configuration interface in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker with the CAP_NET_ADMIN privilege could use this to cause a denial of service (system crash)…

    first Apr 4, 2018
  • Unscored
    USN-3554-1 2 CVEs

    curl vulnerabilities

    It was discovered that curl incorrectly handled certain data. An attacker could possibly use this to cause a denial of service or even to get access to sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. It was discovered that curl cou…

    first Jan 31, 2018
  • Unscored
    USN-3622-1 1 CVE

    wayland vulnerability

    It was discovered that the Wayland Xcursor support incorrectly handled certain files. An attacker could use these issues to cause Wayland to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Apr 9, 2018
  • Unscored
    USN-3577-1 1 CVE

    cups vulnerability

    Jann Horn discovered that CUPS permitted HTTP requests with the Host header set to "localhost.localdomain" from the loopback interface. If a user were tricked in to opening a specially crafted website in their web browser, an attacker could potentially exploi…

    first Feb 21, 2018
  • Unscored
    USN-3604-1 1 CVE

    libvorbis vulnerability

    Richard Zhu discovered that libvorbis incorrectly handled certain sound files. An attacker could use this to cause libvorbis to crash, resulting in a denial or service, or possibly execute arbitrary code.

    first Mar 22, 2018
  • Unscored
    USN-3576-1 3 CVEs

    libvirt vulnerabilities

    Vivian Zhang and Christoph Anton Mitterer discovered that libvirt incorrectly disabled password authentication when the VNC password was set to an empty string. A remote attacker could possibly use this issue to bypass authentication, contrary to expectations…

    first Feb 20, 2018
  • Unscored
    USN-3637-1 5 CVEs

    wavpack vulnerabilities

    Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu discovered that WavPack incorrectly handled certain .wav files. An attacker could possibly use this to execute arbitrary code or cause a denial of service. (CVE-2018-10536, CVE-2018-1053…

    first Apr 30, 2018
  • Unscored
    USN-3610-1 1 CVE

    icu vulnerability

    It was discovered that ICU incorrectly handled certain calendars. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash, leading to a denial of service.

    first Mar 28, 2018
  • Unscored
    USN-3612-1 1 CVE

    librelp vulnerability

    Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly handled checking certain x509 certificates. A remote attacker able to connect to rsyslog could possibly use this issue to execute arbitrary code.

    first Mar 28, 2018