Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,464 results · Feed

  • Unscored
    USN-2290-1 7 CVEs

    linux vulnerabilities

    Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol (PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user could exploit this flaw to gain administrative privileges. (CVE-2014-4943) Salva Peiró discovered an informati…

    first Jul 17, 2014
  • Unscored
    USN-2280-1 1 CVE

    miniupnpc vulnerability

    It was discovered that MiniUPnPc incorrectly handled certain buffer lengths. A remote attacker could possibly use this issue to cause applications using MiniUPnPc to crash, resulting in a denial of service.

    first Jul 16, 2014
  • Medium max 6.5
    USN-2276-1 9 CVEs

    php5 vulnerabilities

    Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service. (CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-20…

    first Jul 9, 2014
  • Unscored
    USN-2274-1 1 CVE

    linux vulnerability

    Andy Lutomirski discovered a flaw with the Linux kernel's ptrace syscall on x86_64 processors. An attacker could exploit this flaw to cause a denial of service (System Crash) or potential gain administrative privileges.

    first Jul 5, 2014
  • Unscored
    USN-2265-1 1 CVE

    nspr vulnerability

    Abhishek Arya discovered that NSPR incorrectly handled certain console functions. A remote attacker could use this issue to cause NSPR to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected re…

    first Jul 2, 2014
  • Unscored
    USN-2257-1 4 CVEs

    samba vulnerabilities

    Christof Schmitt discovered that Samba incorrectly initialized a certain response field when vfs shadow copy was enabled. A remote authenticated attacker could use this issue to possibly obtain sensitive information. This issue only affected Ubuntu 13.10 and …

    first Jun 26, 2014
  • Unscored
    USN-2254-2 0 CVEs

    php5 updates

    USN-2254-1 fixed vulnerabilities in PHP. The fix for CVE-2014-0185 further restricted the permissions on the PHP FastCGI Process Manager (FPM) UNIX socket. This update grants socket access to the www-data user and group so installations and documentation rely…

    first Jun 25, 2014
  • Unscored
    USN-2253-1 1 CVE

    libreoffice vulnerability

    It was discovered that LibreOffice unconditionally executed certain VBA macros, contrary to user expectations.

    first Jun 23, 2014
  • Unscored
    USN-2246-1 1 CVE

    apt vulnerability

    Jakub Wilk discovered that APT did not correctly validate signatures when downloading source packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered source packages.

    first Jun 17, 2014
  • Unscored
    USN-2250-1 3 CVEs

    thunderbird vulnerabilities

    Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden and Kyle Huey discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scriptin…

    first Jun 19, 2014
  • Unscored
    USN-2254-1 4 CVEs

    php5 vulnerabilities

    Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM) set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubu…

    first Jun 23, 2014
  • Unscored
    USN-2306-1 3 CVEs

    eglibc vulnerabilities

    Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS. (CVE-2013-4357) It was discovered that the GNU …

    first Aug 4, 2014
  • Unscored
    USN-2245-1 2 CVEs

    json-c vulnerabilities

    Florian Weimer discovered that json-c incorrectly handled buffer lengths. An attacker could use this issue with a specially-crafted large JSON document to cause json-c to crash, resulting in a denial of service. (CVE-2013-6370) Florian Weimer discovered that …

    first Jun 12, 2014
  • Unscored
    USN-2232-2 0 CVEs

    openssl regression

    USN-2232-1 fixed vulnerabilities in OpenSSL. The upstream fix for CVE-2014-0224 caused a regression for certain applications that use tls_session_secret_cb, such as wpa_supplicant. This update fixes the problem. Original advisory details: Jüri Aedla discovere…

    first Jun 12, 2014
  • Unscored
    USN-2189-1 7 CVEs

    thunderbird vulnerabilities

    Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd and Christian Holler discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting e…

    first Apr 30, 2014
  • Unscored
    USN-2205-1 4 CVEs

    tiff vulnerabilities

    Pedro Ribeiro discovered that LibTIFF incorrectly handled certain malformed images when using the gif2tiff tool. If a user or automated system were tricked into opening a specially crafted GIF image, a remote attacker could crash the application, leading to a…

    first May 6, 2014
  • Unscored
    USN-2242-1 2 CVEs

    dpkg vulnerabilities

    It was discovered that dpkg incorrectly handled certain patches when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack dir…

    first Jun 10, 2014
  • Unscored
    USN-2232-1 4 CVEs

    openssl vulnerabilities

    Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS fragments. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, U…

    first Jun 5, 2014
  • High max 7.8
    USN-2240-1 3 CVEs 1 exploited

    linux vulnerabilities

    Pinkie Pie discovered a flaw in the Linux kernel's futex subsystem. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or gain administrative privileges. (CVE-2014-3153) An information leak was discovered in the net…

    first Jun 5, 2014
  • Unscored
    USN-2213-1 1 CVE

    dovecot vulnerability

    It was discovered that Dovecot incorrectly handled closing inactive SSL/TLS connections. A remote attacker could use this issue to cause Dovecot to stop responding to new connections, resulting in a denial of service.

    first May 15, 2014
  • Unscored
    USN-2216-1 1 CVE

    pidgin vulnerability

    It was discovered that Pidgin incorrectly handled certain messages from Gadu-Gadu file relay servers. A malicious remote server or a machine-in-the-middle could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly execute arb…

    first May 21, 2014
  • Unscored
    USN-2229-1 1 CVE

    gnutls26 vulnerability

    Joonas Kuorilehto discovered that GnuTLS incorrectly handled Server Hello messages. A malicious remote server or a machine-in-the-middle could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jun 2, 2014
  • Unscored
    USN-2243-1 8 CVEs

    firefox vulnerabilities

    Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden, Kyle Huey, Jesse Ruderman, Gregor Wagner, Benoit Jacob and Karl Tomlinson discovered multiple memory safety issues in Firefox. If a user were tricke…

    first Jun 11, 2014
  • Unscored
    USN-2226-1 6 CVEs

    linux vulnerabilities

    Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-1738) Matthew Daley reported a flaw in the h…

    first May 27, 2014
  • Unscored
    USN-2211-1 3 CVEs

    libxfont vulnerabilities

    Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. (CVE-2014-0209) Ilja van Sprundel disc…

    first May 14, 2014
  • Medium max 5.5
    USN-2204-1 1 CVE 1 exploited

    linux vulnerability

    A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain administrator privileges.

    first May 6, 2014
  • Unscored
    USN-2192-1 2 CVEs

    openssl vulnerabilities

    It was discovered that OpenSSL incorrectly handled memory in the ssl3_read_bytes() function. A remote attacker could use this issue to possibly cause OpenSSL to crash, resulting in a denial of service. (CVE-2010-5298) It was discovered that OpenSSL incorrectl…

    first May 5, 2014
  • Unscored
    USN-2214-2 0 CVEs

    libxml2 regression

    USN-2214-1 fixed vulnerabilities in libxml2. The upstream fix introduced a regression when using xmllint with the --postvalid option. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Daniel Berrange discovered that…

    first Jun 9, 2014
  • Unscored
    USN-2210-1 1 CVE

    cups-filters vulnerability

    Sebastian Krahmer discovered that cups-browsed incorrectly filtered remote printer names and strings. A remote attacker could use this issue to possibly execute arbitrary commands. (CVE-2014-2707) Johannes Meixner discovered that cups-browsed ignored invalid …

    first May 8, 2014
  • Unscored
    USN-2232-3 0 CVEs

    openssl regression

    USN-2232-1 fixed vulnerabilities in OpenSSL. The upstream fix for CVE-2014-0224 caused a regression for certain applications that use renegotiation, such as PostgreSQL. This update fixes the problem. Original advisory details: Jüri Aedla discovered that OpenS…

    first Jun 23, 2014
  • Unscored
    USN-2214-1 1 CVE

    libxml2 vulnerability

    Daniel Berrange discovered that libxml2 would incorrectly perform entity substitution even when requested not to. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resu…

    first May 15, 2014
  • Unscored
    USN-2190-1 1 CVE

    jbigkit vulnerability

    Florian Weimer discovered that JBIG-KIT incorrectly handled certain malformed images. If a user or automated system were tricked into processing a specially crafted image, JBIG-KIT could be made to crash, or possibly execute arbitrary code.

    first May 1, 2014
  • Unscored
    USN-2214-3 0 CVEs

    libxml2 regression

    USN-2214-1 fixed vulnerabilities in libxml2. The upstream fix introduced a number of regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Daniel Berrange discovered that libxml2 would incorrectly perform e…

    first Jun 17, 2014
  • Unscored
    USN-2188-1 1 CVE

    elfutils vulnerability

    Florian Weimer discovered that the elfutils libdw library incorrectly handled malformed compressed debug sections in ELF files. If a user or automated system were tricked into processing a specially crafted ELF file, applications linked against libdw could be…

    first Apr 30, 2014
  • Unscored
    USN-2185-1 13 CVEs

    firefox vulnerabilities

    Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd, John Schoenick, Karl Tomlinson, Vladimir Vukicevic and Christian Holler discovered multiple memory safety issues in Firefox. If a user were tricked in to open…

    first Apr 29, 2014
  • Unscored
    USN-2184-2 0 CVEs

    unity vulnerabilities

    USN-2184-1 fixed lock screen vulnerabilities in Unity. Further testing has uncovered more issues which have been fixed in this update. This update also fixes a regression with the shutdown dialogue. We apologize for the inconvenience. Original advisory detail…

    first Apr 30, 2014
  • Unscored
    USN-2184-1 0 CVEs

    unity vulnerabilities

    Frédéric Bardy discovered that Unity incorrectly filtered keyboard shortcuts when the screen was locked. A local attacker could possibly use this issue to run commands, and unlock the current session. Giovanni Mellini discovered that Unity could display the D…

    first Apr 29, 2014
  • Unscored
    USN-2183-1 1 CVE

    dpkg vulnerability

    Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unp…

    first Apr 28, 2014
  • Unscored
    USN-2183-2 1 CVE

    dpkg vulnerability

    USN-2183-1 fixed a vulnerability in dpkg. Javier Serrano Polo discovered that the fix introduced a vulnerability in releases with an older version of the patch utility. This update fixes the problem. Original advisory details: Jakub Wilk discovered that dpkg …

    first May 1, 2014
  • Unscored
    USN-2170-1 9 CVEs

    mysql-5.5 vulnerabilities

    Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to 5.5.37. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly in…

    first Apr 23, 2014