Ubuntu Security Notices (USN)

8,464 results · Feed

• Unscored
  USN-3544-2 0 CVEs

  firefox regressions

  USN-3544-1 fixed vulnerabilities in Firefox. The update caused a web compatibility regression and a tab crash during printing in some circumstances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple securit…

  Apr 22, 2026

  first Feb 12, 2018
• Unscored
  USN-3546-1 1 CVE

  gcab vulnerability

  Richard Hughes discovered that gcab incorrectly handled certain malformed cabinet files. If a user or automated system were tricked into opening a specially crafted cabinet file, a remote attacker could use this issue to cause gcab to crash, resulting in a de…

  Apr 22, 2026

  first Jan 24, 2018
• High max 7.5
  USN-3535-1 1 CVE

  bind9 vulnerability

  Jayachandran Palanisamy discovered that the Bind resolver incorrectly handled fetch cleanup sequencing. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.

  Apr 22, 2026

  first Jan 17, 2018
• Unscored
  USN-3532-1 4 CVEs

  gdk-pixbuf vulnerabilities

  It was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-1000422) Ariel Zelivansky discovered that GDK-PixBuf inco…

  Apr 22, 2026

  first Jan 15, 2018
• Unscored
  USN-3529-1 14 CVEs

  thunderbird vulnerabilities

  It was discovered that a From address encoded with a null character is cut off in the message header display. An attacker could potentially exploit this to spoof the sender address. (CVE-2017-7829) It was discovered that it is possible to execute JavaScript i…

  Apr 22, 2026

  first Jan 29, 2018
• Unscored
  USN-3517-1 2 CVEs

  poppler vulnerabilities

  It was discovered that poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could execute arbitrary. (CVE-2017-1000456) It was discovered that poppler incorrectly handled certain fi…

  Apr 22, 2026

  first Jan 8, 2018
• Unscored
  USN-3510-1 2 CVEs

  linux vulnerabilities

  Mohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16939) It was…

  Apr 22, 2026

  first Dec 8, 2017
• Unscored
  USN-3551-1 8 CVEs

  webkit2gtk vulnerabilities

  Multiple security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the user interface, or exe…

  Apr 22, 2026

  first Jan 30, 2018
• Unscored
  USN-3527-1 4 CVEs

  irssi vulnerabilities

  Joseph Bisch discovered that Irssi incorrectly handled incomplete escape codes. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2…

  Apr 22, 2026

  first Jan 10, 2018
• High max 7.5
  USN-3504-1 1 CVE

  libxml2 vulnerability

  Wei Lei discovered that libxml2 incorrecty handled certain parameter entities. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.

  Apr 22, 2026

  first Dec 5, 2017
• Unscored
  USN-3534-1 7 CVEs

  eglibc, glibc vulnerabilities

  It was discovered that the GNU C library did not properly handle all of the possible return values from the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in setuid programs and gain administrative privileg…

  Apr 22, 2026

  first Jan 17, 2018
• Unscored
  USN-3512-1 2 CVEs

  openssl vulnerabilities

  David Benjamin discovered that OpenSSL did not correctly prevent buggy applications that ignore handshake errors from subsequently calling certain functions. (CVE-2017-3737) It was discovered that OpenSSL incorrectly performed the x86_64 Montgomery multiplica…

  Apr 22, 2026

  first Dec 11, 2017
• Medium max 4.3
  USN-3526-1 1 CVE

  sssd vulnerability

  It was discovered that SSSD incorrectly handled certain inputs when querying its local cache. An attacker could use this to inject arbitrary code and expose sensitive information.

  Apr 22, 2026

  first Jan 10, 2018
• Unscored
  USN-3501-1 1 CVE

  libxcursor vulnerability

  It was discovered that libxcursor incorrectly handled certain files. An attacker could use these issues to cause libxcursor to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Nov 29, 2017
• Unscored
  USN-3503-1 1 CVE

  evince vulnerability

  It was discovered that Evince incorrectly handled printing certain DVI files. If a user were tricked into opening and printing a specially-named DVI file, an attacker could use this issue to execute arbitrary code.

  Apr 22, 2026

  first Dec 4, 2017
• High max 8.8
  USN-3528-1 4 CVEs

  ruby1.9.1, ruby2.3 vulnerabilities

  It was discovered that Ruby incorrectly handled certain terminal emulator escape sequences. An attacker could use this to execute arbitrary code via a crafted user name. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-10784) It was disco…

  Apr 22, 2026

  first Jan 10, 2018
• Unscored
  USN-3509-3 0 CVEs

  linux, linux-aws, linux-kvm, linux-raspi2 regression

  USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. Unfortunately, it also introduced a regression that prevented the Ceph network filesystem from being used. This update fixes the problem. We apologize for the inconvenience. Original a…

  Apr 22, 2026

  first Dec 15, 2017
• Unscored
  USN-3509-1 4 CVEs

  linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

  Mohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16939) It was…

  Apr 22, 2026

  first Dec 7, 2017
• Unscored
  USN-4124-2 1 CVE

  exim4 vulnerability

  USN-4124-1 fixed a vulnerability in Exim. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this iss…

  Apr 22, 2026

  first Sep 16, 2019
• Unscored
  USN-3514-1 4 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

  Apr 22, 2026

  first Jan 3, 2018
• Unscored
  USN-3489-1 1 CVE

  db5.3 vulnerability

  It was discovered that Berkeley DB incorrectly handled certain configuration files. An attacker could possibly use this issue to read sensitive information.

  Apr 22, 2026

  first Nov 21, 2017
• Unscored
  USN-3522-3 0 CVEs

  linux regression

  USN-3522-1 fixed a vulnerability in the Linux kernel to address Meltdown (CVE-2017-5754). Unfortunately, that update introduced a regression where a few systems failed to boot successfully. This update fixes the problem. We apologize for the inconvenience. Or…

  Apr 22, 2026

  first Jan 10, 2018
• Unscored
  USN-3500-1 1 CVE

  libxfont, libxfont1, libxfont2 vulnerability

  It was discovered that libXfont incorrectly followed symlinks when opening font files. A local unprivileged user could use this issue to cause the X server to access arbitrary files, including special device files.

  Apr 22, 2026

  first Nov 29, 2017
• Unscored
  USN-3481-1 13 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

  Apr 22, 2026

  first Nov 16, 2017
• High max 8.8
  USN-3513-1 1 CVE

  libxml2 vulnerability

  It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.

  Apr 22, 2026

  first Dec 13, 2017
• Unscored
  USN-3485-1 13 CVEs

  linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

  It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-…

  Apr 22, 2026

  first Nov 21, 2017
• Unscored
  USN-3479-1 2 CVEs

  postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerabilities

  David Rowley discovered that PostgreSQL incorrectly handled memory when processing certain JSON functions. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2017-15098) Dean Rasheed discovered that PostgreSQL incorrectly en…

  Apr 22, 2026

  first Nov 14, 2017
• Unscored
  USN-3491-1 3 CVEs

  ldns vulnerabilities

  Leon Weber discovered that the ldns-keygen tool incorrectly set permissions on private keys. A local attacker could possibly use this issue to obtain generated private keys. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-3209) Stephan Zeisberg discove…

  Apr 22, 2026

  first Nov 22, 2017
• Unscored
  USN-3496-3 1 CVE

  python3.4, python3.5 vulnerability

  USN-3496-1 fixed a vulnerability in Python2.7. This update provides the corresponding update for versions 3.4 and 3.5. Original advisory details: It was discovered that Python incorrectly handled decoding certain strings. An attacker could possibly use this i…

  Apr 22, 2026

  first Nov 28, 2017
• Unscored
  USN-3477-1 14 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, bypass sa…

  Apr 22, 2026

  first Nov 16, 2017
• Unscored
  USN-3515-1 1 CVE

  ruby1.9.1, ruby2.0, ruby2.3 vulnerability

  It was discovered that Ruby allows FTP command injection. An attacker could use this to cause arbitrary command execution.

  Apr 22, 2026

  first Jan 4, 2018
• Unscored
  USN-3477-3 0 CVEs

  firefox regressions

  USN-3477-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tr…

  Apr 22, 2026

  first Dec 1, 2017
• High max 7.8
  USN-3474-1 1 CVE

  liblouis vulnerability

  Raphael Sanchez Prudencio discovered that Liblouis incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a denial of service or potentially execute arbitrary code.

  Apr 22, 2026

  first Nov 6, 2017
• Unscored
  USN-3478-1 2 CVEs

  perl vulnerabilities

  Jakub Wilk discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-12837, CVE-2017-12883)

  Apr 22, 2026

  first Nov 13, 2017
• Medium max 5.5
  USN-4488-1 4 CVEs

  xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04 vulnerabilities

  Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled the input extension protocol. A local attacker could possibly use this issue to escalate privileges. (CVE-2020-14346) Jan-Niklas Sohn discovered that the X.Org X Server incorrectly initial…

  Apr 22, 2026

  first Sep 2, 2020
• Unscored
  USN-3477-2 0 CVEs

  firefox regression

  USN-3477-1 fixed vulnerabilities in Firefox. The update caused search suggestions to not be displayed when performing Google searches from the search bar. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple s…

  Apr 22, 2026

  first Nov 27, 2017
• Unscored
  USN-3496-1 1 CVE

  python2.7 vulnerability

  It was discovered that Python incorrectly handled decoding certain strings. An attacker could possibly use this issue to execute arbitrary code.

  Apr 22, 2026

  first Nov 28, 2017
• Unscored
  USN-3467-1 1 CVE

  poppler vulnerability

  It was discovered that Poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service.

  Apr 22, 2026

  first Oct 30, 2017
• High max 8.8
  USN-3462-1 2 CVEs

  pacemaker vulnerabilities

  Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled the IPC interface. A local attacker could possibly use this issue to execute arbitrary code with root privileges. (CVE-2016-7035) Alain Moulle discovered that Pacemaker incorrectly han…

  Apr 22, 2026

  first Oct 24, 2017
• Unscored
  USN-3490-1 3 CVEs

  thunderbird vulnerabilities

  Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing-like context, an attacker could potentially exploit these to bypass same-origin restrictions, cause a denial of service via…

  Apr 22, 2026

  first Dec 1, 2017