Ubuntu Security Notices (USN)

8,464 results · Feed

• Unscored
  USN-2837-1 1 CVE

  bind9 vulnerability

  It was discovered that Bind incorrectly handled responses with malformed class attributes. A remote attacker could use this issue to cause Bind to crash, resulting in a denial of service.

  Apr 22, 2026

  first Dec 15, 2015
• Unscored
  USN-2861-1 2 CVEs

  libpng vulnerabilities

  It was discovered that libpng incorrectly handled certain small bit-depth values. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or execute code with …

  Apr 22, 2026

  first Jan 6, 2016
• Unscored
  USN-2834-1 8 CVEs

  libxml2 vulnerabilities

  Kostya Serebryany discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of servic…

  Apr 22, 2026

  first Dec 14, 2015
• Unscored
  USN-2859-1 5 CVEs

  thunderbird vulnerabilities

  Andrei Vaida, Jesse Ruderman, Bob Clary, and Jesse Ruderman discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via…

  Apr 22, 2026

  first Jan 13, 2016
• Unscored
  USN-2832-1 3 CVEs

  libsndfile vulnerabilities

  It was discovered that libsndfile incorrectly handled memory when parsing malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.…

  Apr 22, 2026

  first Dec 7, 2015
• Unscored
  USN-2821-1 0 CVEs

  gnutls26 vulnerability

  It was discovered that GnuTLS incorrectly validated the first byte of padding in CBC modes. A remote attacker could possibly use this issue to perform a padding oracle attack.

  Apr 22, 2026

  first Nov 30, 2015
• Unscored
  USN-2856-1 2 CVEs

  ldb vulnerabilities

  Thilo Uttendorfer discovered that the ldb incorrectly handled certain zero values. A remote attacker could use this issue to cause applications using ldb, such as Samba, to stop responding, resulting in a denial of service. (CVE-2015-3223) Douglas Bagnall dis…

  Apr 22, 2026

  first Jan 5, 2016
• Unscored
  USN-2866-1 1 CVE

  firefox vulnerability

  Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information.

  Apr 22, 2026

  first Jan 8, 2016
• High max 7.1
  USN-3882-1 3 CVEs

  curl vulnerabilities

  Wenxiang Qian discovered that curl incorrectly handled certain NTLM authentication messages. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LT…

  Apr 22, 2026

  first Feb 6, 2019
• Unscored
  USN-2839-1 0 CVEs

  cups update

  As a security improvement against the POODLE attack, this update disables SSLv3 support in the CUPS web interface. For legacy environments where SSLv3 support is still required, it can be re-enabled by adding "SSLOptions AllowSSL3" to /etc/cups/cupsd.conf.

  Apr 22, 2026

  first Dec 16, 2015
• Unscored
  USN-2838-1 1 CVE

  cups-filters vulnerability

  Adam Chester discovered that the cups-filters foomatic-rip filter incorrectly stripped shell escape characters. A remote attacker could possibly use this issue to execute arbitrary code as the lp user.

  Apr 22, 2026

  first Dec 16, 2015
• Unscored
  USN-2823-1 2 CVEs

  linux vulnerabilities

  It was discovered that the SCTP protocol implementation in the Linux kernel performed an incorrect sequence of protocol-initialization steps. A local attacker could use this to cause a denial of service (system crash). (CVE-2015-5283) Dmitry Vyukov discovered…

  Apr 22, 2026

  first Dec 1, 2015
• Unscored
  USN-2815-1 2 CVEs

  libpng vulnerabilities

  Mikulas Patocka discovered that libpng incorrectly handled certain large fields. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause libpng to crash, leading to a denial of se…

  Apr 22, 2026

  first Nov 19, 2015
• Unscored
  USN-2831-1 1 CVE

  cups-filters vulnerability

  Michal Kowalczyk discovered that the cups-filters foomatic-rip filter incorrectly stripped shell escape characters. A remote attacker could possibly use this issue to execute arbitrary code as the lp user.

  Apr 22, 2026

  first Dec 7, 2015
• Unscored
  USN-2814-1 1 CVE

  nvidia-graphics-drivers-304, nvidia-graphics-drivers-304-updates, nvidia-graphics-drivers-340, nvidia-graphics-drivers-340-updates, nvidia-graphics-drivers-352, nvidia-graphics-drivers-352-updates vulnerability

  It was discovered that the NVIDIA graphics drivers incorrectly sanitized user mode inputs. A local attacker could use this issue to possibly gain root privileges.

  Apr 22, 2026

  first Nov 18, 2015
• Unscored
  USN-2833-1 21 CVEs

  firefox vulnerabilities

  Andrei Vaida, Jesse Ruderman, Bob Clary, Christian Holler, Jesse Ruderman, Eric Rahm, Robert Kaiser, Harald Kirschner, and Michael Henretty discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, …

  Apr 22, 2026

  first Dec 15, 2015
• Unscored
  USN-2830-1 5 CVEs

  openssl vulnerabilities

  Guy Leaver discovered that OpenSSL incorrectly handled a ServerKeyExchange for an anonymous DH ciphersuite with the value of p set to 0. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue on…

  Apr 22, 2026

  first Dec 7, 2015
• Unscored
  USN-2812-1 4 CVEs

  libxml2 vulnerabilities

  Florian Weimer discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in a denial of service. This is…

  Apr 22, 2026

  first Nov 16, 2015
• Unscored
  USN-2810-1 7 CVEs

  krb5 vulnerabilities

  It was discovered that the Kerberos kpasswd service incorrectly handled certain UDP packets. A remote attacker could possibly use this issue to cause resource consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2002-…

  Apr 22, 2026

  first Nov 12, 2015
• Unscored
  USN-2819-1 12 CVEs

  thunderbird vulnerabilities

  Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky, Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafte…

  Apr 22, 2026

  first Dec 1, 2015
• Unscored
  USN-2776-1 4 CVEs

  linux vulnerabilities

  It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to th…

  Apr 22, 2026

  first Oct 19, 2015
• Unscored
  USN-2785-1 18 CVEs

  firefox vulnerabilities

  Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky, Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, Gary Kwong, Andrew McCreight, Georg Fritzsche, and Carsten Book discovered multiple memory safety issues in Firefox. If a user …

  Apr 22, 2026

  first Nov 4, 2015
• Unscored
  USN-2780-1 1 CVE

  miniupnpc vulnerability

  Aleksandar Nikolic discovered a buffer overflow vulnerability in the XML parser functionality of the MiniUPnP library. A remote attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code with privileges of the …

  Apr 22, 2026

  first Oct 20, 2015
• Unscored
  USN-2820-1 1 CVE

  dpkg vulnerability

  Hanno Boeck discovered that the dpkg-deb tool incorrectly handled certain old style Debian binary packages. If a user or an automated system were tricked into unpacking a specially crafted binary package, a remote attacker could possibly use this issue to exe…

  Apr 22, 2026

  first Nov 26, 2015
• Unscored
  USN-2801-1 1 CVE

  linux vulnerability

  Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the host OS.

  Apr 22, 2026

  first Nov 10, 2015
• Unscored
  USN-2786-1 2 CVEs

  php5 vulnerabilities

  It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-7803, CVE-2015-7804)

  Apr 22, 2026

  first Oct 28, 2015
• Unscored
  USN-2791-1 2 CVEs

  nss vulnerabilities

  Tyson Smith and David Keeler discovered that NSS incorrectly handled decoding certain ASN.1 data. An remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Nov 4, 2015
• Unscored
  USN-2790-1 1 CVE

  nspr vulnerability

  Ryan Sleevi discovered that NSPR incorrectly handled memory allocation. A remote attacker could use this issue to cause NSPR to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Nov 4, 2015
• Unscored
  USN-2753-3 0 CVEs

  lxc regression

  USN-2753-1 fixed a vulnerability in LXC. The update caused a regression that prevented some containers from starting. This regression only affected containers that had a path that contained a '/./' directory specified as a bind mount target in their configura…

  Apr 22, 2026

  first Oct 5, 2015
• Unscored
  USN-2794-1 2 CVEs

  linux vulnerabilities

  It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. (CVE-2015-2925) Moein Ghasemzadeh discovered t…

  Apr 22, 2026

  first Nov 5, 2015
• Unscored
  USN-2758-1 10 CVEs

  php5 vulnerabilities

  It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-5589) It was discovered that the PHP phar extension incorrectly handled …

  Apr 22, 2026

  first Sep 30, 2015
• Unscored
  USN-2753-2 0 CVEs

  lxc regression

  USN-2753-1 fixed a vulnerability in LXC. The update caused a regression that prevented some containers from starting. This regression only affected containers that had an absolute path specified as a bind mount target in their configuration file. This update …

  Apr 22, 2026

  first Sep 30, 2015
• Unscored
  USN-2766-1 2 CVEs

  spice vulnerabilities

  Frediano Ziglio discovered multiple buffer overflows, undefined behavior signed integer operations, race conditions, memory leaks, and denial of service issues in Spice. A malicious guest operating system could potentially exploit these issues to escape virtu…

  Apr 22, 2026

  first Oct 7, 2015
• Unscored
  USN-2767-1 2 CVEs

  gdk-pixbuf vulnerabilities

  Gustavo Grieco discovered that the GDK-PixBuf library did not properly handle scaling tga image files, leading to a heap overflow. If a user or automated system were tricked into opening a tga image file, a remote attacker could use this flaw to cause GDK-Pix…

  Apr 22, 2026

  first Oct 13, 2015
• Unscored
  USN-2772-1 2 CVEs

  postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities

  Josh Kupershmidt discovered the pgCrypto extension could expose several bytes of server memory if the crypt() function was provided a too-short salt. An attacker could use this flaw to read private data. (CVE-2015-5288) Oskari Saarenmaa discovered that the js…

  Apr 22, 2026

  first Oct 16, 2015
• Unscored
  USN-2793-1 4 CVEs

  libreoffice vulnerabilities

  Federico Scrinzi discovered that LibreOffice incorrectly handled documents inserted into Writer or Calc via links. If a user were tricked into opening a specially crafted document, a remote attacker could possibly obtain the contents of arbitrary files. (CVE-…

  Apr 22, 2026

  first Nov 5, 2015
• Unscored
  USN-2787-1 1 CVE

  audiofile vulnerability

  Fabrizio Gennari discovered that audiofile incorrectly handled changing both the sample format and the number of channels. If a user or automated system were tricked into processing a specially crafted file, audiofile could be made to crash, leading to a deni…

  Apr 22, 2026

  first Oct 28, 2015
• Unscored
  USN-2754-1 14 CVEs

  thunderbird vulnerabilities

  Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, and Cameron McCormack discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could …

  Apr 22, 2026

  first Oct 5, 2015
• Unscored
  USN-2768-1 1 CVE

  firefox vulnerability

  Abdulrahman Alqabandi and Ben Kelly discovered that the fetch() API did not correctly implement the Cross Origin Resource Sharing (CORS) specification. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit thi…

  Apr 22, 2026

  first Oct 16, 2015
• Unscored
  USN-2753-1 1 CVE

  lxc vulnerability

  Roman Fiedler discovered a directory traversal flaw in lxc-start. A local attacker with access to an LXC container could exploit this flaw to run programs inside the container that are not confined by AppArmor or expose unintended files in the host to the con…

  Apr 22, 2026

  first Sep 29, 2015