Ubuntu Security Notices (USN)

8,464 results · Feed

• Unscored
  USN-2553-2 0 CVEs

  tiff regression

  USN-2553-1 fixed vulnerabilities in LibTIFF. One of the security fixes caused a regression when saving certain TIFF files with a Predictor tag. The problematic patch has been temporarily backed out until a more complete fix is available. We apologize for the …

  Apr 22, 2026

  first Apr 1, 2015
• Unscored
  USN-2550-1 14 CVEs

  firefox vulnerabilities

  Olli Pettay and Boris Zbarsky discovered an issue during anchor navigations in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin policy restrictions. (CVE-201…

  Apr 22, 2026

  first Apr 1, 2015
• Unscored
  USN-2522-1 10 CVEs

  icu vulnerabilities

  It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the …

  Apr 22, 2026

  first Mar 5, 2015
• Unscored
  USN-2507-1 2 CVEs

  e2fsprogs vulnerabilities

  Jose Duart discovered that e2fsprogs incorrectly handled invalid block group descriptor data. A local attacker could use this issue with a crafted filesystem image to possibly execute arbitrary code. (CVE-2015-0247, CVE-2015-1572)

  Apr 22, 2026

  first Feb 23, 2015
• Unscored
  USN-2528-1 1 CVE

  linux vulnerability

  It was discovered that the Linux kernel's Infiniband subsystem did not properly sanitize its input parameters while registering memory regions from userspace. A local user could exploit this flaw to cause a denial of service (system crash) or to potentially g…

  Apr 22, 2026

  first Mar 12, 2015
• Unscored
  USN-2532-1 1 CVE

  cups-filters vulnerability

  It was discovered that cups-browsed incorrectly filtered remote printer names and strings. A remote attacker could use this issue to possibly execute arbitrary commands.

  Apr 22, 2026

  first Mar 16, 2015
• Unscored
  USN-2524-1 1 CVE

  ecryptfs-utils vulnerability

  Sylvain Pelissier discovered that eCryptfs did not generate a random salt when encrypting the mount passphrase with the login password. An attacker could use this issue to discover the login password used to protect the mount passphrase and gain unintended ac…

  Apr 22, 2026

  first Mar 11, 2015
• Unscored
  USN-2516-2 0 CVEs

  linux vulnerability

  USN-2516-1 fixed vulnerabilities in the Linux kernel. There was an unrelated regression in the use of the virtual counter (CNTVCT) on arm64 architectures. This update fixes the problem. We apologize for the inconvenience. Original advisory details: A flaw was…

  Apr 22, 2026

  first Feb 28, 2015
• Unscored
  USN-2549-1 2 CVEs

  libarchive vulnerabilities

  It was discovered that the libarchive bsdcpio utility extracted absolute paths by default without using the --insecure flag, contrary to expectations. If a user or automated system were tricked into extracting cpio archives containing absolute paths, a remote…

  Apr 22, 2026

  first Mar 25, 2015
• Unscored
  USN-2535-1 4 CVEs

  php5 vulnerabilities

  Thomas Jarosch discovered that PHP incorrectly limited recursion in the fileinfo extension. A remote attacker could possibly use this issue to cause PHP to consume resources or crash, resulting in a denial of service. (CVE-2014-8117) S. Paraschoudis discovere…

  Apr 22, 2026

  first Mar 18, 2015
• Unscored
  USN-2544-1 8 CVEs

  linux vulnerabilities

  Eric Windisch discovered flaw in how the Linux kernel's XFS file system replaces remote attributes. A local access with access to an XFS file system could exploit this flaw to escalate their privileges. (CVE-2015-0274) A flaw was discovered in the automatic l…

  Apr 22, 2026

  first Mar 24, 2015
• Unscored
  USN-2523-1 3 CVEs

  apache2 vulnerabilities

  Martin Holst Swende discovered that the mod_headers module allowed HTTP trailers to replace HTTP headers during request processing. A remote attacker could possibly use this issue to bypass RequestHeaders directives. (CVE-2013-5704) Mark Montague discovered t…

  Apr 22, 2026

  first Mar 10, 2015
• Unscored
  USN-2538-1 2 CVEs

  firefox vulnerabilities

  A flaw was discovered in the implementation of typed array bounds checking in the Javascript just-in-time compilation. If a user were tricked in to opening a specially crafted website, an attacked could exploit this to execute arbitrary code with the privileg…

  Apr 22, 2026

  first Mar 22, 2015
• Unscored
  USN-2508-1 1 CVE

  samba vulnerability

  Richard van Eeden discovered that the Samba smbd file services incorrectly handled memory. A remote attacker could use this issue to possibly execute arbitrary code with root privileges.

  Apr 22, 2026

  first Feb 23, 2015
• Unscored
  USN-2520-1 1 CVE

  cups vulnerability

  Peter De Wachter discovered that CUPS incorrectly handled certain malformed compressed raster files. A remote attacker could use this issue to cause CUPS to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Feb 26, 2015
• Unscored
  USN-2510-1 20 CVEs

  freetype vulnerabilities

  Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privi…

  Apr 22, 2026

  first Feb 24, 2015
• Unscored
  USN-2516-3 0 CVEs

  linux vulnerabilities

  USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in USN-2516-2 was incomplete. There was an unrelated regression in the use of the virtual counter (CNTVCT) on arm64 architectures. This update fixes the problem. We apologize for the inconvenie…

  Apr 22, 2026

  first Mar 4, 2015
• Unscored
  USN-2516-1 12 CVEs

  linux vulnerabilities

  A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of the SYSTENTER instruction when the guest OS does not initialize the SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of service of the guest OS (crash) or potenti…

  Apr 22, 2026

  first Feb 26, 2015
• Unscored
  USN-2506-1 4 CVEs

  thunderbird vulnerabilities

  Armin Razmdjou discovered that contents of locally readable files could be made available via manipulation of form autocomplete in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could p…

  Apr 22, 2026

  first Mar 3, 2015
• Unscored
  USN-2498-1 7 CVEs

  krb5 vulnerabilities

  It was discovered that Kerberos incorrectly sent old keys in response to a -randkey -keepold request. An authenticated remote attacker could use this issue to forge tickets by leveraging administrative access. This issue only affected Ubuntu 10.04 LTS, Ubuntu…

  Apr 22, 2026

  first Feb 10, 2015
• Unscored
  USN-2504-1 0 CVEs

  nss update

  The NSS package contained outdated CA certificates. This update refreshes the NSS package to version 3.17.4 which includes the latest CA certificate bundle.

  Apr 22, 2026

  first Feb 19, 2015
• Unscored
  USN-2496-1 9 CVEs

  binutils vulnerabilities

  Michal Zalewski discovered that the setup_group function in libbfd in GNU binutils did not properly check group headers in ELF files. An attacker could use this to craft input that could cause a denial of service (application crash) or possibly execute arbitr…

  Apr 22, 2026

  first Feb 9, 2015
• Unscored
  USN-2505-2 0 CVEs

  firefox regression

  USN-2505-1 fixed vulnerabilities in Firefox. This update removed the deprecated "-remote" command-line switch that some older software still depends on. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Matthew Noor…

  Apr 22, 2026

  first Mar 9, 2015
• Unscored
  USN-2501-1 7 CVEs

  php5 vulnerabilities

  Stefan Esser discovered that PHP incorrectly handled unserializing objects. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-8142, CVE-2015-0231) Brian Carpenter disc…

  Apr 22, 2026

  first Feb 17, 2015
• Unscored
  USN-2505-1 16 CVEs

  firefox vulnerabilities

  Matthew Noorenberghe discovered that Mozilla domains in the allowlist could make UITour API calls from background tabs. If one of these domains were compromised and open in a background tab, an attacker could potentially exploit this to conduct clickjacking a…

  Apr 22, 2026

  first Feb 25, 2015
• Unscored
  USN-2499-1 4 CVEs

  postgresql-8.4, postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities

  Stephen Frost discovered that PostgreSQL incorrectly displayed certain values in error messages. An authenticated user could gain access to seeing certain values, contrary to expected permissions. (CVE-2014-8161) Andres Freund, Peter Geoghegan and Noah Misch …

  Apr 22, 2026

  first Feb 11, 2015
• Unscored
  USN-2503-1 1 CVE

  bind9 vulnerability

  Jan-Piet Mens discovered that Bind incorrectly handled Trust Anchor Management. A remote attacker could use this issue to cause bind to crash, resulting in a denial of service.

  Apr 22, 2026

  first Feb 18, 2015
• Unscored
  USN-2481-1 1 CVE

  samba vulnerability

  Andrew Bartlett discovered that Samba incorrectly handled delegation of authority when being used as an Active Directory Domain Controller. An attacker given delegation privileges could use this issue to escalate their privileges further.

  Apr 22, 2026

  first Jan 22, 2015
• Unscored
  USN-2494-1 3 CVEs

  file vulnerabilities

  Francisco Alonso discovered that file incorrectly handled certain ELF files. An attacker could use this issue to cause file to crash, resulting in a denial of service. (CVE-2014-3710) Thomas Jarosch discovered that file incorrectly handled certain ELF files. …

  Apr 22, 2026

  first Feb 4, 2015
• Unscored
  USN-2477-1 1 CVE

  libevent vulnerability

  Andrew Bartlett discovered that libevent incorrectly handled large inputs to the evbuffer API. A remote attacker could possibly use this issue with an application that uses libevent to cause a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Jan 19, 2015
• Unscored
  USN-2478-1 1 CVE

  libssh vulnerability

  It was discovered that libssh incorrectly handled certain kexinit packets. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service.

  Apr 22, 2026

  first Jan 19, 2015
• Unscored
  USN-2484-1 1 CVE

  unbound vulnerability

  Florian Maury discovered that Unbound incorrectly handled delegation. A remote attacker could possibly use this issue to cause Unbound to consume resources, resulting in a denial of service.

  Apr 22, 2026

  first Jan 26, 2015
• Unscored
  USN-2488-1 1 CVE

  clamav vulnerability

  Sebastian Andrzej Siewior discovered that ClamAV incorrectly handled certain upack packer files. An attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Apr 22, 2026

  first Feb 2, 2015
• Unscored
  USN-2483-1 4 CVEs

  jasper vulnerabilities

  Jose Duart discovered that JasPer incorrectly handled ICC color profiles in JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code w…

  Apr 22, 2026

  first Jan 26, 2015
• Unscored
  USN-2479-1 2 CVEs

  rpm vulnerabilities

  Florian Weimer discovered that RPM incorrectly handled temporary files. A local attacker could use this issue to execute arbitrary code. (CVE-2013-6435) Florian Weimer discovered that RPM incorrectly handled certain CPIO headers. If a user or automated system…

  Apr 22, 2026

  first Jan 19, 2015
• Unscored
  USN-2482-1 1 CVE

  elfutils vulnerability

  Alexander Cherepanov discovered that libelf1 incorrectly handled certain filesystem paths while extracting ar archives. An attacker could use this flaw to perform a directory traversal attack on the root directory if the process extracting the ar archive has …

  Apr 22, 2026

  first Jan 23, 2015
• Unscored
  USN-2480-1 6 CVEs

  mysql-5.5 vulnerabilities

  Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to 5.5.41. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly in…

  Apr 22, 2026

  first Jan 22, 2015
• Unscored
  USN-2461-1 1 CVE

  libyaml vulnerability

  Stanisław Pitucha and Jonathan Gray discovered that LibYAML did not properly handle wrapped strings. An attacker could create specially crafted YAML data to trigger an assert, causing a denial of service.

  Apr 22, 2026

  first Jan 12, 2015
• Unscored
  USN-2474-1 1 CVE

  curl vulnerability

  Andrey Labunets discovered that curl incorrectly handled certain URLs when using a proxy server. If a user or automated system were tricked into using a specially crafted URL, an attacker could possibly use this issue to inject arbitrary HTTP requests.

  Apr 22, 2026

  first Jan 15, 2015
• Unscored
  USN-2475-1 0 CVEs

  gtk+3.0 update

  Clemens Fries discovered that GTK+ allowed bypassing certain screen locks by using the menu key. An attacker with physical access could possibly use this flaw to gain access to a locked session.

  Apr 22, 2026

  first Jan 15, 2015