Ubuntu Security Notices (USN)

8,464 results · Feed

• High max 8.8
  USN-3418-1 3 CVEs

  gdk-pixbuf vulnerabilities

  It was discovered that the GDK-PixBuf library did not properly handle certain jpeg images. If an user or automated system were tricked into opening a specially crafted jpeg file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in…

  Apr 22, 2026

  first Sep 18, 2017
• Unscored
  USN-3429-1 1 CVE

  libplist vulnerability

  Wang Junjie discovered that Libplist incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a crash or denial or service.

  Apr 22, 2026

  first Sep 25, 2017
• Unscored
  USN-3391-3 0 CVEs

  firefox regression

  USN-3391-1 fixed vulnerabilities in Firefox. The update introduced a performance regression with WebExtensions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. …

  Apr 22, 2026

  first Aug 17, 2017
• Unscored
  USN-3376-1 13 CVEs

  webkit2gtk vulnerabilities

  A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

  Apr 22, 2026

  first Aug 2, 2017
• Unscored
  USN-3382-1 13 CVEs

  php5, php7.0 vulnerabilities

  It was discovered that the PHP opcache created keys for files it cached based on their filepath. A local attacker could possibly use this issue in a shared hosting environment to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-20…

  Apr 22, 2026

  first Aug 10, 2017
• Unscored
  USN-3400-1 1 CVE

  augeas vulnerability

  It was discovered that Augeas incorrectly handled certain strings. An attacker could use this issue to cause Augeas to crash, leading to a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Aug 21, 2017
• Unscored
  USN-3370-1 1 CVE

  apache2 vulnerability

  Robert Święcki discovered that the Apache HTTP Server mod_auth_digest module incorrectly cleared values when processing certain requests. A remote attacker could use this issue to cause the server to crash, resulting in a denial or service, or possibly obtain…

  Apr 22, 2026

  first Jul 27, 2017
• High max 7.1
  USN-3381-1 4 CVEs

  linux vulnerabilities

  Peter Pi discovered that the colormap handling for frame buffer devices in the Linux kernel contained an integer overflow. A local attacker could use this to disclose sensitive information (kernel memory). (CVE-2016-8405) It was discovered that the Linux kern…

  Apr 22, 2026

  first Aug 7, 2017
• Unscored
  USN-3408-1 5 CVEs

  liblouis vulnerabilities

  It was discovered that an illegal address access can be made in Liblouis. A remote attacker can take advantange of this to access sensitive information. (CVE-2017-13738, CVE-2017-13744) It was discovered a heap-based buffer overflow that causes bytes out-of-b…

  Apr 22, 2026

  first Sep 4, 2017
• Unscored
  USN-3395-1 1 CVE

  c-ares vulnerability

  It was discovered that c-ares incorrectly handled certain NAPTR responses. A remote attacker could possibly use this issue to cause applications using c-ares to crash, resulting in a denial of service.

  Apr 22, 2026

  first Aug 17, 2017
• Unscored
  USN-3409-1 8 CVEs

  fontforge vulnerabilities

  It was discovered that FontForge was vulnerable to a heap-based buffer over-read. A remote attacker could use a crafted file to DoS or execute arbitrary code. (CVE-2017-11568, CVE-2017-11569, CVE-2017-11572) It was discovered that FontForge was vulnerable to …

  Apr 22, 2026

  first Sep 4, 2017
• Unscored
  USN-3398-1 8 CVEs

  graphite2 vulnerabilities

  Holger Fuhrmannek and Tyson Smith discovered that graphite2 incorrectly handled certain malformed fonts. If a user or automated system were tricked into opening a specially-crafted font file, a remote attacker could use this issue to cause graphite2 to crash,…

  Apr 22, 2026

  first Aug 21, 2017
• Unscored
  USN-3392-1 0 CVEs

  linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon regression

  USN-3378-1 fixed vulnerabilities in the Linux kernel. Unfortunately, a regression was introduced that prevented conntrack from working correctly in some situations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: …

  Apr 22, 2026

  first Aug 16, 2017
• Unscored
  USN-3369-1 6 CVEs

  freeradius vulnerabilities

  Guido Vranken discovered that FreeRADIUS incorrectly handled memory when decoding packets. A remote attacker could use this issue to cause FreeRADIUS to crash or hang, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jul 27, 2017
• Unscored
  USN-3394-1 2 CVEs

  libmspack vulnerabilities

  It was discovered that libmspack incorrectly handled certain malformed CHM files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-6419) It was discovered that …

  Apr 22, 2026

  first Aug 17, 2017
• Unscored
  USN-3391-1 25 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to conduct cross-site scripting (XSS) attacks, bypass sandbox restrictions, obtain sensitive inf…

  Apr 22, 2026

  first Aug 15, 2017
• Unscored
  USN-3355-1 1 CVE

  spice vulnerability

  Frediano Ziglio discovered that Spice incorrectly handled certain invalid monitor configurations. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jul 19, 2017
• High max 7.1
  USN-3378-1 4 CVEs

  linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities

  Fan Wu and Shixiong Zhao discovered a race condition between inotify events and vfs rename operations in the Linux kernel. An unprivileged local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2017-7533) It …

  Apr 22, 2026

  first Aug 3, 2017
• Unscored
  USN-3385-1 2 CVEs

  linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities

  Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload (UFO) code in the Linux kernel. A local attacker could use this to cause a denial of service or execute arbitrary code. (CVE-2017-1000112) Andrey Konovalov discovered a race conditi…

  Apr 22, 2026

  first Aug 11, 2017
• Unscored
  USN-3363-1 19 CVEs

  imagemagick vulnerabilities

  It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

  Apr 22, 2026

  first Jul 24, 2017
• Medium max 5.9
  USN-3362-1 3 CVEs

  xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities

  It was discovered that the X.Org X server incorrectly handled endianness conversion of certain X events. An attacker able to connect to an X server, either locally or remotely, could use this issue to crash the server, or possibly execute arbitrary code as an…

  Apr 22, 2026

  first Jul 24, 2017
• Unscored
  USN-3351-1 1 CVE

  evince vulnerability

  Felix Wilhelm discovered that Evince did not safely invoke tar when handling tar comic book (cbt) files. An attacker could use this to construct a malicious cbt comic book format file that, when opened in Evince, executes arbitrary code. Please note that this…

  Apr 22, 2026

  first Jul 13, 2017
• Unscored
  USN-3375-1 1 CVE

  lxc vulnerability

  It was discovered that LXC incorrectly handled the TIOCSTI ioctl. An attacker could possibly use this issue to escape LXC containers.

  Apr 22, 2026

  first Aug 2, 2017
• Unscored
  USN-3336-1 1 CVE

  nss vulnerability

  It was discovered that NSS incorrectly handled certain empty SSLv2 messages. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service.

  Apr 22, 2026

  first Jun 21, 2017
• Unscored
  USN-3353-2 1 CVE

  samba vulnerability

  USN-3353-1 fixed a vulnerability in Heimdal. This update provides the corresponding update for Samba. Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams discovered that Samba clients incorrectly trusted unauthenticated portions of Kerberos tickets. A remot…

  Apr 22, 2026

  first Jul 14, 2017
• Unscored
  USN-3343-1 10 CVEs

  linux vulnerabilities

  USN 3335-1 fixed a vulnerability in the Linux kernel. However, that fix introduced regressions for some Java applications. This update addresses the issue. We apologize for the inconvenience. It was discovered that a use-after-free vulnerability in the core v…

  Apr 22, 2026

  first Jun 29, 2017
• Unscored
  USN-3364-1 6 CVEs

  linux, linux-raspi2, linux-snapdragon vulnerabilities

  It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2014-9900) It was discovered that the Linux kernel did not properly restri…

  Apr 22, 2026

  first Jul 24, 2017
• Unscored
  USN-3346-2 0 CVEs

  bind9 regression

  USN-3346-1 fixed vulnerabilities in Bind. The fix for CVE-2017-3142 introduced a regression in the ability to receive an AXFR or IXFR in the case where TSIG is used and not every message is signed. This update fixes the problem. In addition, this update adds …

  Apr 22, 2026

  first Sep 18, 2017
• Unscored
  USN-3335-1 1 CVE

  linux vulnerability

  It was discovered that the stack guard page for processes in the Linux kernel was not sufficiently large enough to prevent overlapping with the heap. An attacker could leverage this with another vulnerability to execute arbitrary code and gain administrative …

  Apr 22, 2026

  first Jun 22, 2017
• Unscored
  USN-3320-1 7 CVEs

  zziplib vulnerabilities

  Agostino Sarubbo discovered that zziplib incorrectly handled certain malformed ZIP files. If a user or automated system were tricked into opening a specially crafted ZIP file, a remote attacker could cause zziplib to crash, resulting in a denial of service, o…

  Apr 22, 2026

  first Jun 15, 2017
• Unscored
  USN-3340-1 4 CVEs

  apache2 vulnerabilities

  Emmanuel Dreyfus discovered that third-party modules using the ap_get_basic_auth_pw() function outside of the authentication phase may lead to authentication requirements being bypassed. This update adds a new ap_get_basic_auth_components() function for use b…

  Apr 22, 2026

  first Jun 26, 2017
• Unscored
  USN-3322-1 1 CVE

  exim4 vulnerability

  It was discovered that Exim did not properly deallocate memory when processing certain command line arguments. A local attacker could use this in conjunction with a vulnerability in the underlying kernel to possibly execute arbitrary code and gain administrat…

  Apr 22, 2026

  first Jun 19, 2017
• Unscored
  USN-3323-1 1 CVE

  eglibc, glibc vulnerability

  It was discovered that the GNU C library did not properly handle memory when processing environment variables for setuid programs. A local attacker could use this in combination with another vulnerability to gain administrative privileges.

  Apr 22, 2026

  first Jun 19, 2017
• Unscored
  USN-3363-2 0 CVEs

  imagemagick regression

  USN-3363-1 fixed vulnerabilities in ImageMagick. The update caused a regression for certain users when processing images. The problematic patch has been reverted pending further investigation. We apologize for the inconvenience. Original advisory details: It …

  Apr 22, 2026

  first Jul 31, 2017
• Medium max 6.1
  USN-3347-1 2 CVEs

  libgcrypt11, libgcrypt20 vulnerabilities

  Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom discovered that Libgcrypt was susceptible to an attack via side channels. A local attacker could use this atta…

  Apr 22, 2026

  first Jul 3, 2017
• High max 7.0
  USN-3360-1 15 CVEs

  linux vulnerabilities

  It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2014-9900) It was discovered that the Linux kernel did not properly restri…

  Apr 22, 2026

  first Jul 21, 2017
• Unscored
  USN-3353-1 1 CVE

  heimdal vulnerability

  Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams discovered that Heimdal clients incorrectly trusted unauthenticated portions of Kerberos tickets. A remote attacker could use this to impersonate trusted network services or perform other attacks.

  Apr 22, 2026

  first Jul 14, 2017
• Unscored
  USN-3315-1 21 CVEs

  firefox vulnerabilities

  Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, spoof the…

  Apr 22, 2026

  first Jun 15, 2017
• Medium max 4.4
  USN-3312-1 15 CVEs

  linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities

  It was discovered that the netfilter netlink implementation in the Linux kernel did not properly validate batch messages. A local attacker with the CAP_NET_ADMIN capability could use this to expose sensitive information or cause a denial of service. (CVE-2016…

  Apr 22, 2026

  first Jun 7, 2017
• Unscored
  USN-3302-1 26 CVEs

  imagemagick vulnerabilities

  It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

  Apr 22, 2026

  first May 30, 2017