Ubuntu Security Notices (USN)

8,464 results · Feed

• Unscored
  USN-2621-1 3 CVEs

  postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities

  Benkocs Norbert Attila discovered that PostgreSQL incorrectly handled authentication timeouts. A remote attacker could use this flaw to cause the unauthenticated session to crash, possibly leading to a security issue. (CVE-2015-3165) Noah Misch discovered tha…

  Apr 22, 2026

  first May 25, 2015
• Unscored
  USN-2675-1 2 CVEs

  lxc vulnerabilities

  Roman Fiedler discovered that LXC had a directory traversal flaw when creating lock files. A local attacker could exploit this flaw to create an arbitrary file as the root user. (CVE-2015-1331) Roman Fiedler discovered that LXC incorrectly trusted the contain…

  Apr 22, 2026

  first Jul 22, 2015
• Unscored
  USN-2643-2 0 CVEs

  linux regression

  The Fix for CVE-2015-1328 introduced a regression into the Linux kernel's overlayfs file system. The removal of a directory that only exists on the lower layer results in a kernel panic. We apologize for the inconvenience. Original advisory details: Philip Pe…

  Apr 22, 2026

  first Jun 21, 2015
• Unscored
  USN-2634-1 2 CVEs

  linux vulnerabilities

  Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping support. A local user could exploit this flaw to cause a denial of service (system crash) or gain administrative privileges on the system. (CVE-2015-3636) A memory corruption flaw was dis…

  Apr 22, 2026

  first Jun 10, 2015
• Medium max 5.9
  USN-2653-1 5 CVEs

  python2.7, python3.2, python3.4 vulnerabilities

  It was discovered that multiple Python protocol libraries incorrectly limited certain data when connecting to servers. A malicious ftp, http, imap, nntp, pop or smtp server could use this issue to cause a denial of service. (CVE-2013-1752) It was discovered t…

  Apr 22, 2026

  first Jun 25, 2015
• Unscored
  USN-2643-1 1 CVE

  linux vulnerability

  Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system.

  Apr 22, 2026

  first Jun 15, 2015
• Unscored
  USN-2617-1 1 CVE

  fuse vulnerability

  Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges.

  Apr 22, 2026

  first May 21, 2015
• Unscored
  USN-2604-1 1 CVE

  libtasn1-3, libtasn1-6 vulnerability

  Hanno Böck discovered that Libtasn1 incorrectly handled certain ASN.1 data. A remote attacker could possibly exploit this with specially crafted ASN.1 data and cause applications using Libtasn1 to crash, resulting in a denial of service, or possibly execute a…

  Apr 22, 2026

  first May 11, 2015
• Unscored
  USN-2659-1 2 CVEs

  cups-filters vulnerabilities

  Petr Sklenar discovered that the cups-filters texttopdf filter incorrectly handled line sizes. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code as the lp user. (CVE-2015-3258, CVE-2015-3279)

  Apr 22, 2026

  first Jul 6, 2015
• Unscored
  USN-2598-2 0 CVEs

  linux vulnerability

  USN-2598-1 fixed vulnerabilities in the Linux kernel, however an unrelated regression in the auditing of some path names was introduced. Due to the regression the system could crash under certain conditions. This update fixes the problem. We apologize for the…

  Apr 22, 2026

  first May 9, 2015
• Unscored
  USN-2622-1 2 CVEs

  openldap vulnerabilities

  It was discovered that OpenLDAP incorrectly handled certain search queries that returned empty attributes. A remote attacker could use this issue to cause OpenLDAP to assert, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-20…

  Apr 22, 2026

  first May 26, 2015
• Unscored
  USN-2626-1 5 CVEs

  qt4-x11, qtbase-opensource-src vulnerabilities

  Wolfgang Schenk discovered that Qt incorrectly handled certain malformed GIF images. If a user or automated system were tricked into opening a specially crafted GIF image, a remote attacker could use this issue to cause Qt to crash, resulting in a denial of s…

  Apr 22, 2026

  first Jun 3, 2015
• Unscored
  USN-2639-1 6 CVEs

  openssl vulnerabilities

  Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that OpenSSL incorrectly handled memory when buffering DTLS data. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitra…

  Apr 22, 2026

  first Jun 11, 2015
• Unscored
  USN-2614-1 4 CVEs

  linux vulnerabilities

  Vincent Tondellier discovered an integer overflow in the Linux kernel's netfilter connection tracking accounting of loaded extensions. An attacker on the local area network (LAN) could potential exploit this flaw to cause a denial of service (system crash of …

  Apr 22, 2026

  first May 20, 2015
• Unscored
  USN-2620-1 1 CVE

  linux vulnerability

  A flaw was discovered in the Linux kernel's IPv4 networking when using TCP fast open to initiate a connection. An unprivileged local user could exploit this flaw to cause a denial of service (system crash).

  Apr 22, 2026

  first May 23, 2015
• Unscored
  USN-2605-1 2 CVEs

  icu vulnerabilities

  Pedro Ribeiro discovered that ICU incorrectly handled certain memory operations when processing data. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user…

  Apr 22, 2026

  first May 11, 2015
• Unscored
  USN-2603-1 4 CVEs

  thunderbird vulnerabilities

  Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause …

  Apr 22, 2026

  first May 18, 2015
• Unscored
  USN-2581-1 1 CVE

  network-manager vulnerability

  Tavis Ormandy discovered that NetworkManager incorrectly filtered paths when requested to read modem device contexts. A local attacker could possibly use this issue to bypass privileges and manipulate modem device configuration or read arbitrary files.

  Apr 22, 2026

  first Apr 28, 2015
• Unscored
  USN-2602-1 10 CVEs

  firefox vulnerabilities

  Jesse Ruderman, Mats Palmgren, Byron Campen, Steve Fink, Gary Kwong, Andrew McCreight, Christian Holler, Jon Coppeard, and Milan Sreckovic discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, a…

  Apr 22, 2026

  first May 13, 2015
• Unscored
  USN-2598-1 1 CVE

  linux vulnerability

  A race condition between chown() and execve() was discovered in the Linux kernel. A local attacker could exploit this race by using chown on a setuid-user-binary to gain administrative privileges.

  Apr 22, 2026

  first May 5, 2015
• Unscored
  USN-2578-1 2 CVEs

  libreoffice vulnerabilities

  Alexander Cherepanov discovered that LibreOffice incorrectly handled certain RTF files. If a user were tricked into opening a specially crafted RTF document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2014-90…

  Apr 22, 2026

  first Apr 27, 2015
• Unscored
  USN-2595-1 1 CVE

  ppp vulnerability

  It was discovered that ppp incorrectly handled large PIDs. When pppd is used with a RADIUS server, a remote attacker could use this issue to cause it to crash, resulting in a denial of service.

  Apr 22, 2026

  first May 5, 2015
• Unscored
  USN-2588-1 2 CVEs

  linux vulnerabilities

  A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of service (kernel crash) or to potentially execute code with kernel privileges. (CVE-2015-2666) It was discover…

  Apr 22, 2026

  first Apr 30, 2015
• Unscored
  USN-2566-1 1 CVE

  dpkg vulnerability

  Jann Horn discovered that dpkg incorrectly validated signatures when extracting local source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could bypass signature verification check…

  Apr 22, 2026

  first Apr 9, 2015
• Unscored
  USN-2591-1 5 CVEs

  curl vulnerabilities

  Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP credentials when subsequently connecting to the same host over HTTP. (CVE-2015-3143) Hanno Böck discovered that curl incorrectly handled zero-length host names. If a user or automated system…

  Apr 22, 2026

  first Apr 30, 2015
• Unscored
  USN-2575-1 8 CVEs

  mysql-5.5 vulnerabilities

  Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to 5.5.43. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly in…

  Apr 22, 2026

  first Apr 21, 2015
• Unscored
  USN-2568-1 1 CVE

  libx11, libxrender vulnerability

  Abhishek Arya discovered that libX11 incorrectly handled memory in the MakeBigReq macro. A remote attacker could use this issue to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code. In addition, following the ma…

  Apr 22, 2026

  first Apr 13, 2015
• Unscored
  USN-2555-1 2 CVEs

  libgcrypt11, libgcrypt20 vulnerabilities

  Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2014-3591) Daniel Genkin, Adi Shamir,…

  Apr 22, 2026

  first Apr 1, 2015
• Unscored
  USN-2559-1 1 CVE

  libtasn1-3, libtasn1-6 vulnerability

  Hanno Böck discovered that Libtasn1 incorrectly handled certain ASN.1 data. A remote attacker could possibly exploit this with specially crafted ASN.1 data and cause applications using Libtasn1 to crash, resulting in a denial of service, or possibly execute a…

  Apr 22, 2026

  first Apr 8, 2015
• Unscored
  USN-2557-1 1 CVE

  firefox vulnerability

  Muneaki Nishimura discovered a flaw in Mozilla's HTTP Alternative Services implementation which meant SSL certificate verification could be bypassed in some circumstances. A remote attacker could potentially exploit this to conduct a machine-in-the-middle att…

  Apr 22, 2026

  first Apr 7, 2015
• Unscored
  USN-2552-1 5 CVEs

  thunderbird vulnerabilities

  Olli Pettay and Boris Zbarsky discovered an issue during anchor navigations in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to bypass same-origin policy…

  Apr 22, 2026

  first Apr 2, 2015
• High max 7.7
  USN-3881-1 1 CVE

  dovecot vulnerability

  It was discovered that Dovecot incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.

  Apr 22, 2026

  first Feb 5, 2019
• Unscored
  USN-2547-1 5 CVEs

  mono vulnerabilities

  It was discovered that the Mono TLS implementation was vulnerable to the SKIP-TLS vulnerability. A remote attacker could possibly use this issue to perform client impersonation attacks. (CVE-2015-2318) It was discovered that the Mono TLS implementation was vu…

  Apr 22, 2026

  first Mar 24, 2015
• Unscored
  USN-2540-1 2 CVEs

  gnutls26, gnutls28 vulnerabilities

  It was discovered that GnuTLS did not perform date and time checks on CA certificates, contrary to expectations. This issue only affected Ubuntu 10.04 LTS. (CVE-2014-8155) Nikos Mavrogiannopoulos discovered that GnuTLS incorrectly verified that signature algo…

  Apr 22, 2026

  first Mar 23, 2015
• Unscored
  USN-2553-1 6 CVEs

  tiff vulnerabilities

  William Robinet discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly…

  Apr 22, 2026

  first Mar 31, 2015
• Unscored
  USN-2563-1 5 CVEs

  linux vulnerabilities

  Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate the…

  Apr 22, 2026

  first Apr 8, 2015
• Unscored
  USN-2571-1 1 CVE

  firefox vulnerability

  Robert Kaiser discovered a use-after-free during plugin initialization in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or ex…

  Apr 22, 2026

  first Apr 24, 2015
• Unscored
  USN-2519-1 4 CVEs

  eglibc, glibc vulnerabilities

  Arnaud Le Blanc discovered that the GNU C Library incorrectly handled file descriptors when resolving DNS queries under high load. This may cause a denial of service in other applications, or an information leak. This issue only affected Ubuntu 10.04 LTS, Ubu…

  Apr 22, 2026

  first Feb 26, 2015
• Unscored
  USN-2536-1 3 CVEs

  libxfont vulnerabilities

  Ilja van Sprundel, Alan Coopersmith, and William Robinet discovered that libXfont incorrectly handled malformed bdf fonts. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges.

  Apr 22, 2026

  first Mar 18, 2015
• Unscored
  USN-2537-1 7 CVEs

  openssl vulnerabilities

  It was discovered that OpenSSL incorrectly handled malformed EC private key files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0209) Stephen Henson discovere…

  Apr 22, 2026

  first Mar 19, 2015