Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,464 results · Feed

  • Medium max 6.7
    USN-6744-2 1 CVE

    pillow vulnerability

    USN-6744-1 fixed a vulnerability in Pillow (Python 3). This update provides the corresponding updates for Pillow (Python 2) in Ubuntu 20.04 LTS. Original advisory details: Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when…

    first Apr 22, 2024
  • Unscored
    USN-6728-2 0 CVEs

    squid regression

    USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused Squid to crash in certain environments on Ubuntu 20.04 LTS. The problematic fix has been reverted pending further investigation. We apologize for the inconvenience. Original advisory …

    first Apr 11, 2024
  • Unscored
    USN-6714-1 1 CVE

    debian-goodies vulnerability

    It was discovered that debmany in Debian Goodies incorrectly handled certain deb files. An attacker could possibly use this issue to execute arbitrary shell commands.

    first Mar 25, 2024
  • High max 7.8
    USN-6697-1 1 CVE

    bash vulnerability

    It was discovered that Bash incorrectly handled certain memory operations when processing commands. If a user or automated system were tricked into running a specially crafted bash file, a remote attacker could use this issue to cause Bash to crash, resulting…

    first Mar 18, 2024
  • High max 7.5
    USN-6693-1 1 CVE

    dotnet7, dotnet8 vulnerability

    It was discovered that .NET did not properly handle certain specially crafted requests. An attacker could potentially use this issue to cause a resource leak, leading to a denial of service.

    first Mar 12, 2024
  • Medium max 6.5
    USN-6691-1 1 CVE

    ovn vulnerability

    It was discovered that OVN incorrectly enabled OVS Bidirectional Forwarding Detection on logical ports. A remote attacker could possibly use this issue to disrupt traffic.

    first Mar 12, 2024
  • High max 7.5
    USN-6683-1 1 CVE

    libhtmlcleaner-java vulnerability

    It was discovered that HtmlCleaner incorrectly handled certain html documents. An attacker could possibly use this issue to cause a denial of service via application crash.

    first Mar 7, 2024
  • Medium max 6.2
    USN-6679-1 1 CVE

    frr vulnerability

    It was discovered that FRR incorrectly handled certain malformed OSPF LSA packets. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service.

    first Mar 6, 2024
  • Critical max 9.8
    USN-6675-1 1 CVE

    ruby-image-processing vulnerability

    It was discovered that ImageProcessing incorrectly handled series of operations that are coming from unsanitised inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue…

    first Mar 5, 2024
  • High max 7.5
    USN-6673-3 1 CVE

    python-cryptography vulnerability

    USN-6673-1 provided a security update for python-cryptography. This update provides the corresponding update for Ubuntu 24.04 LTS. Original advisory details: It was discovered that python-cryptography incorrectly handled memory operations when processing mism…

    first May 27, 2024
  • High max 7.5
    USN-6673-1 2 CVEs

    python-cryptography vulnerabilities

    Hubert Kario discovered that python-cryptography incorrectly handled errors returned by the OpenSSL API when processing incorrect padding in RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose confidential or sensitive information. (CVE…

    first Mar 4, 2024
  • High max 7.5
    USN-6634-1 2 CVEs

    dotnet6, dotnet7, dotnet8 vulnerabilities

    Brennan Conroy discovered that .NET with SignalR did not properly handle malicious clients. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21386) Bahaa Naamneh discovered that .NET with OpenSSL support did not properly parse…

    first Feb 13, 2024
  • High max 7.8
    USN-6614-1 1 CVE

    amanda vulnerability

    It was discovered that amanda did not properly check certain arguments. A local unprivileged attacker could possibly use this issue to perform a privilege escalation attack.

    first Jan 30, 2024
  • Medium max 5.9
    USN-6595-1 1 CVE

    pycryptodome vulnerability

    It was discovered that PyCryptodome had a timing side-channel when performing OAEP decryption. A remote attacker could possibly use this issue to recover sensitive information.

    first Jan 23, 2024
  • High max 8.6
    USN-6594-1 3 CVEs

    squid vulnerabilities

    Joshua Rogers discovered that Squid incorrectly handled HTTP message processing. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-49285) Joshua Rogers discovered that Squid incorrectly handle…

    first Jan 23, 2024
  • Critical max 9.1
    USN-6578-1 2 CVEs

    dotnet6, dotnet7, dotnet8 vulnerabilities

    Vishal Mishra and Anita Gaud discovered that .NET did not properly validate X.509 certificates with malformed signatures. An attacker could possibly use this issue to bypass an application's typical authentication logic. (CVE-2024-0057) Morgan Brown discovere…

    first Jan 11, 2024
  • High max 7.8
    USN-6576-1 1 CVE

    linux-oem-6.1 vulnerability

    Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle an expired catchall element in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system cras…

    first Jan 10, 2024
  • Unscored
    USN-6567-2 0 CVEs

    qemu regression

    USN-6567-1 fixed vulnerabilities QEMU. The fix for CVE-2023-2861 was too restrictive and introduced a behaviour change leading to a regression in certain environments. This update fixes the problem. Original advisory details: Gaoning Pan and Xingwei Li discov…

    first Jun 6, 2024
  • Low max 3.3
    USN-6553-1 1 CVE

    pydantic vulnerability

    Nina Jensen discovered that Pydantic incorrectly handled user input in the date and datetime fields. An attacker could possibly use this issue to cause a denial of service via application crash. (CVE-2021-29510)

    first Dec 12, 2023
  • Unscored
    USN-6552-1 1 CVE

    netatalk vulnerability

    Florent Saudel and Arnaud Gatignol discovered that Netatalk incorrectly handled certain specially crafted Spotlight requests. A remote attacker could possibly use this issue to cause heap corruption and execute arbitrary code. (CVE-2023-42464)

    first Dec 12, 2023
  • High max 8.2
    USN-6530-1 1 CVE

    haproxy vulnerability

    It was discovered that HAProxy incorrectly handled URI components containing the hash character (#). A remote attacker could possibly use this issue to obtain sensitive information, or to bypass certain path_end rules.

    first Dec 5, 2023
  • Unscored
    USN-6519-1 0 CVEs

    ec2-hibinit-agent update

    The EC2 hibagent package has been updated to add IMDSv2 support, as IMDSv1 uses an insecure protocol and is no longer recommended.

    first Nov 28, 2023
  • High max 7.5
    USN-6504-1 1 CVE

    tracker-miners vulnerability

    It was discovered that tracker-miners incorrectly handled sandboxing. If a second security issue was discovered in tracker-miners, an attacker could possibly use this issue in combination with it to escape the sandbox.

    first Nov 22, 2023
  • High max 7.5
    USN-6498-1 4 CVEs

    frr vulnerabilities

    It was discovered that FRR incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service.

    first Nov 21, 2023
  • Unscored
    USN-6493-1 0 CVEs

    hibagent update

    On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, the hibagent package has been updated to add IMDSv2 support, as IMDSv1 uses an insecure protocol and is no longer recommended. In addition, on all releases, hibagent has been updated to do nothing if ODH is configured.

    first Nov 21, 2023
  • Medium max 5.3
    USN-6489-1 1 CVE

    tang vulnerability

    Brian McDermott discovered that Tang incorrectly handled permissions when creating/rotating keys. A local attacker could possibly use this issue to read the keys.

    first Nov 20, 2023
  • Critical max 9.8
    USN-6488-1 1 CVE

    strongswan vulnerability

    Florian Picca discovered that strongSwan incorrectly handled certain DH public values. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Nov 20, 2023
  • High max 7.6
    USN-6480-1 2 CVEs

    dotnet6, dotnet7, dotnet8 vulnerabilities

    Barry Dorrans discovered that .NET did not properly implement certain security features for Blazor server forms. An attacker could possibly use this issue to bypass validation, which could trigger unintended actions. (CVE-2023-36558) Piotr Bazydlo discovered …

    first Nov 15, 2023
  • Unscored
    USN-6476-1 2 CVEs

    memcached vulnerabilities

    It was discovered that Memcached incorrectly handled certain multiget requests in proxy mode. A remote attacker could use this issue to cause Memcached to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-46852) It was dis…

    first Nov 13, 2023
  • Critical max 9.1
    USN-6436-1 3 CVEs

    frr vulnerabilities

    It was discovered that the FRR did not properly check the attribute length in NRLI. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41358) It was discovered that the FRR did not properly manage memory when reading initi…

    first Oct 18, 2023
  • Critical max 9.8
    USN-6424-1 1 CVE

    ruby-kramdown vulnerability

    It was discovered that kramdown did not restrict Rouge formatters to the correct namespace. An attacker could use this issue to cause kramdown to execute arbitrary code.

    first Oct 10, 2023
  • Unscored
    USN-6375-1 0 CVEs

    atftp vulnerability

    Florian Fainelli discovered that atftp did not properly manage requests made to a non-existent file, which could lead to a crash. A remote attacker could possibly use this issue to cause a denial of service.

    first Sep 15, 2023
  • Medium max 6.5
    USN-6362-2 1 CVE

    .Net regressions

    USN-6362-1 fixed vulnerabilities in .Net. It was discovered that the fix for [CVE-2023-36799](https://ubuntu.com/security/CVE-2023-36799) was incomplete. This update fixes the problem. Original advisory details: Kevin Jones discovered that .NET did not proper…

    first Oct 25, 2023
  • Medium max 6.5
    USN-6362-1 1 CVE

    dotnet6, dotnet7 vulnerability

    Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service.

    first Sep 12, 2023
  • Critical max 9.8
    USN-6352-1 2 CVEs

    shiro vulnerabilities

    It was discovered that Apache Shiro incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to bypass security restrictions. (CVE-2020-13933, CVE-2020-17510)

    first Sep 7, 2023
  • Unscored
    USN-6323-1 1 CVE

    frr vulnerability

    Ben Cartwright-Cox discovered that FRR did not handle RFC 7606 attributes properly. A remote attacker could possibly use this to cause denial of service.

    first Aug 31, 2023
  • Unscored
    USN-6304-1 2 CVEs

    inetutils vulnerabilities

    It was discovered that telnetd in GNU Inetutils incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS (CVE-2022-39028) It was discovered that Inetutils in…

    first Aug 22, 2023
  • Unscored
    USN-6294-2 1 CVE

    haproxy vulnerability

    USN-6294-1 fixed vulnerabilities in HAProxy. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly …

    first Aug 17, 2023
  • Unscored
    USN-6294-1 1 CVE

    haproxy vulnerability

    Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the payload and bypass certain restrictions.

    first Aug 16, 2023
  • High max 7.8
    USN-6278-2 3 CVEs 1 exploited

    dotnet6, dotnet7 vulnerabilities

    USN-6278-1 fixed several vulnerabilities in .NET. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that .NET did properly handle the execution of certain commands. An attacker could possibly use…

    first Aug 10, 2023