Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,464 results · Feed

  • Unscored
    USN-3348-1 1 CVE

    samba vulnerability

    It was discovered that Samba incorrectly handled dangling symlinks. A remote attacker could possibly use this issue to cause Samba to hang, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-9461) In …

    first Jul 5, 2017
  • Unscored
    USN-3344-1 8 CVEs

    linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities

    USN 3328-1 fixed a vulnerability in the Linux kernel. However, that fix introduced regressions for some Java applications. This update addresses the issue. We apologize for the inconvenience. Roee Hay discovered that the parallel port printer driver in the Li…

    first Jun 29, 2017
  • Unscored
    USN-3311-1 1 CVE

    libnl3 vulnerability

    It was discovered that libnl incorrectly handled memory when performing certain operations. A local attacker could possibly use this issue to cause libnl to crash, resulting in a denial of service, or execute arbitrary code.

    first Jun 6, 2017
  • High max 8.8
    USN-3350-1 7 CVEs

    poppler vulnerabilities

    Aleksandar Nikolic discovered that poppler incorrectly handled JPEG 2000 images. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the …

    first Jul 7, 2017
  • Unscored
    USN-3328-1 1 CVE

    linux vulnerability

    It was discovered that the stack guard page for processes in the Linux kernel was not sufficiently large enough to prevent overlapping with the heap. An attacker could leverage this with another vulnerability to execute arbitrary code and gain administrative …

    first Jun 22, 2017
  • Unscored
    USN-3291-1 4 CVEs

    linux vulnerabilities

    Dmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux kernel contained a stack-based buffer overflow. A local attacker with access to an sg device could use this to cause a denial of service (system crash) or possibly execute arbitrary co…

    first May 17, 2017
  • Unscored
    USN-3318-1 2 CVEs

    gnutls26, gnutls28 vulnerabilities

    Hubert Kario discovered that GnuTLS incorrectly handled decoding a status response TLS extension. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 1…

    first Jun 13, 2017
  • Unscored
    USN-3317-1 2 CVEs

    irssi vulnerabilities

    It was discovered that Irssi incorrectly handled certain DCC messages. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-9468) Joseph Bisch discovered that Irssi incorrectly handled receiving inco…

    first Jun 12, 2017
  • Unscored
    USN-3306-1 8 CVEs

    libsndfile vulnerabilities

    Agostino Sarubbo and Jakub Jirasek discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jun 1, 2017
  • Unscored
    USN-3298-1 1 CVE

    miniupnpc vulnerability

    It was discovered that MiniUPnP incorrectly handled memory. A remote attacker could use this issue to cause a denial of service or possibly execute arbitrary code with privileges of the user running an application that uses the MiniUPnP library.

    first May 24, 2017
  • High max 7.5
    USN-3346-1 2 CVEs

    bind9 vulnerabilities

    Clément Berthaux discovered that Bind did not correctly check TSIG authentication for zone update requests. An attacker could use this to improperly perform zone updates. (CVE-2017-3143) Clément Berthaux discovered that Bind did not correctly check TSIG authe…

    first Jun 29, 2017
  • Unscored
    USN-3319-1 1 CVE

    libmwaw vulnerability

    It was discovered that libmwaw incorrectly handled certain malformed document files. If a user or automated system were tricked into opening a specially crafted file, a remote attacker could cause libmwaw to crash, resulting in a denial of service, or possibl…

    first Jun 15, 2017
  • Unscored
    USN-3305-1 3 CVEs

    nvidia-graphics-drivers-375 vulnerabilities

    It was discovered that the NVIDIA graphics drivers contained flaws in the kernel mode layer. A local attacker could use these issues to cause a denial of service or potentially escalate their privileges on the system.

    first May 31, 2017
  • Critical max 9.8
    USN-3296-1 1 CVE 1 exploited

    samba vulnerability

    It was discovered that Samba incorrectly handled shared libraries. A remote attacker could use this flaw to upload a shared library to a writable share and execute arbitrary code.

    first May 24, 2017
  • Unscored
    USN-3303-1 3 CVEs

    webkit2gtk vulnerabilities

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site …

    first May 30, 2017
  • Unscored
    USN-3309-1 1 CVE

    libtasn1-6 vulnerability

    Jakub Jirasek discovered that GnuTLS incorrectly handled certain assignments files. If a user were tricked into processing a specially crafted assignments file, a remote attacker could possibly execute arbirary code.

    first Jun 5, 2017
  • Unscored
    USN-3307-1 1 CVE

    openldap vulnerability

    Karsten Heymann discovered that OpenLDAP incorrectly handled certain search requests. A remote attacker could use this issue to cause slapd to crash, resulting in a denial of service.

    first Jun 1, 2017
  • Unscored
    USN-3321-1 19 CVEs

    thunderbird vulnerabilities

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensit…

    first Jul 5, 2017
  • Unscored
    USN-3290-1 1 CVE

    linux vulnerability

    Marco Grassi discovered that the TCP implementation in the Linux kernel mishandles socket buffer (skb) truncation. A local attacker could use this to cause a denial of service (system crash).

    first May 17, 2017
  • Medium max 5.3
    USN-3297-1 4 CVEs

    jbig2dec vulnerabilities

    Bingchang Liu discovered that jbig2dec incorrectly handled memory when decoding malformed image files. If a user or automated system were tricked into processing a specially crafted JBIG2 image file, a remote attacker could cause jbig2dec to crash, resulting …

    first May 24, 2017
  • Unscored
    USN-3283-1 3 CVEs

    rtmpdump vulnerabilities

    Dave McDaniel discovered that rtmpdump incorrectly handled certain malformed streams. If a user were tricked into processing a specially crafted stream, a remote attacker could cause rtmpdump to crash, resulting in a denial of service, or possibly execute arb…

    first May 9, 2017
  • Low max 3.7
    USN-3258-1 1 CVE

    dovecot vulnerability

    It was discovered that Dovecot incorrectly handled some usernames. An attacker could possibly use this issue to cause Dovecot to hang or crash, resulting in a denial of service.

    first Apr 10, 2017
  • Unscored
    USN-3279-1 3 CVEs

    apache2 vulnerabilities

    It was discovered that the Apache mod_session_crypto module was encrypting data and cookies using either CBC or ECB modes. A remote attacker could possibly use this issue to perform padding oracle attacks. (CVE-2016-0736) Maksim Malyutin discovered that the A…

    first May 9, 2017
  • High max 7.8
    USN-3295-1 11 CVEs

    jasper vulnerabilities

    It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly …

    first May 18, 2017
  • Unscored
    USN-3286-1 1 CVE

    kde4libs vulnerability

    Sebastian Krahmer discovered that the KDE-Libs Kauth component incorrectly checked services invoking D-Bus. A local attacker could use this issue to gain root privileges.

    first May 15, 2017
  • Unscored
    USN-3282-1 2 CVEs

    freetype vulnerabilities

    It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, resulting in a denial of service, or possibly execute arbi…

    first May 9, 2017
  • Unscored
    USN-3273-1 2 CVEs

    libreoffice vulnerabilities

    It was discovered that LibreOffice incorrectly handled EMF image files. If a user were tricked into opening a specially crafted EMF image file, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code.

    first May 2, 2017
  • Unscored
    USN-3299-1 0 CVEs

    firefox update

    Some security information preloaded in Firefox was due to expire before the next scheduled release. This update bumps the expiration times.

    first May 25, 2017
  • Unscored
    USN-3274-1 2 CVEs

    icu vulnerabilities

    It was discovered that ICU incorrectly handled certain memory operations when processing data. If an application using ICU processed crafted data, a remote attacker could possibly cause it to crash or potentially execute arbitrary code with the privileges of …

    first May 2, 2017
  • Unscored
    USN-3255-1 1 CVE

    lightdm vulnerability

    It was discovered that LightDM incorrectly handled home directory creation for guest users. A local attacker could use this issue to gain ownership of arbitrary directory paths and possibly gain administrative privileges.

    first Apr 4, 2017
  • Unscored
    USN-3249-1 1 CVE

    linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerability

    It was discovered that the xfrm framework for transforming packets in the Linux kernel did not properly validate data received from user space. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code with administ…

    first Mar 29, 2017
  • Unscored
    USN-3272-2 0 CVEs

    ghostscript regression

    USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduced a regression when the DELAYBIND feature is used with the eqproc command. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered th…

    first May 16, 2017
  • Low max 3.7
    USN-3258-2 1 CVE

    dovecot regression

    USN-3258-1 intended to fix a vulnerability in Dovecot. Further investigation revealed that only Dovecot versions 2.2.26 and newer were affected by the vulnerability. Additionally, the change introduced a regression when Dovecot was configured to use the "dict…

    first Apr 11, 2017
  • Unscored
    USN-3288-1 12 CVEs

    libytnef vulnerabilities

    It was discovered that libytnef incorrectly handled malformed TNEF streams. If a user were tricked into opening a specially crafted TNEF attachment, an attacker could cause a denial of service or possibly execute arbitrary code.

    first May 15, 2017
  • Critical max 9.8
    USN-5504-1 17 CVEs

    firefox vulnerabilities

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass CSP restrictions, bypass sandboxed ifr…

    first Jul 5, 2022
  • Unscored
    USN-3250-1 1 CVE

    linux vulnerability

    It was discovered that the xfrm framework for transforming packets in the Linux kernel did not properly validate data received from user space. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code with administ…

    first Mar 29, 2017
  • High max 7.8
    USN-3272-1 6 CVEs 1 exploited

    ghostscript vulnerabilities

    It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby allowing the execution of arbitrary code, or cause…

    first Apr 28, 2017
  • Unscored
    USN-3256-1 1 CVE

    linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon, linux-ti-omap4 vulnerability

    Andrey Konovalov discovered that the AF_PACKET implementation in the Linux kernel did not properly validate certain block-size data. A local attacker could use this to cause a denial of service (system crash).

    first Apr 5, 2017
  • High max 8.8
    USN-3271-1 6 CVEs

    libxslt vulnerabilities

    Holger Fuhrmannek discovered an integer overflow in the xsltAddTextString() function in Libxslt. An attacker could use this to craft a malicious document that, when opened, could cause a denial of service (application crash) or possible execute arbitrary code…

    first Apr 28, 2017
  • Unscored
    USN-3242-2 0 CVEs

    samba regression

    USN-3242-1 fixed a vulnerability in Samba. The upstream fix introduced a regression when Samba is configured to disable following symbolic links. This update fixes the problem. Original advisory details: Jann Horn discovered that Samba incorrectly handled sym…

    first Mar 30, 2017