Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,466 results · Feed

  • Medium max 6.5
    USN-4315-2 2 CVEs

    apport vulnerabilities

    USN-4315-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Maximilien Bourgeteau discovered that the Apport lock file was created with insecure permissions. This could all…

    first Jun 15, 2020
  • Medium max 6.5
    USN-4315-1 2 CVEs

    apport vulnerabilities

    Maximilien Bourgeteau discovered that the Apport lock file was created with insecure permissions. This could allow a local attacker to escalate their privileges via a symlink attack. (CVE-2020-8831) Maximilien Bourgeteau discovered a race condition in Apport …

    first Apr 2, 2020
  • High max 7.8
    USN-4313-1 1 CVE

    linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerability

    Manfred Paul discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use this to expose sensitive information (kernel memory) or gain administrative privileges.

    first Mar 30, 2020
  • Critical max 9.8
    USN-4308-2 4 CVEs

    twisted vulnerabilities

    USN-4308-1 fixed several vulnerabilities in Twisted. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attack…

    first Mar 30, 2020
  • Unscored
    USN-4306-1 3 CVEs

    dino-im vulnerabilities

    It was discovered that Dino incorrectly validated inputs. An attacker could use this issue to possibly obtain, inject or remove sensitive information. This update also includes a fix to the encryption implementation in Dino to support 12 byte IVs, in addition…

    first Mar 17, 2020
  • High max 7.5
    USN-4297-1 2 CVEs

    runc vulnerabilities

    It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount over the /proc directory and escalate privileges. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-16884) It was discovered th…

    first Mar 9, 2020
  • High max 8.8
    USN-4296-1 1 CVE

    python-django vulnerability

    Norbert Szetei discovered that Django incorrectly handled the GIS functions and aggregates on Oracle. A remote attacker could possibly use this issue to perform an SQL injection attack.

    first Mar 4, 2020
  • Medium max 6.4
    USN-4295-1 1 CVE

    rake vulnerability

    It was discovered that Rake incorrectly handled certain files. An attacker could use this issue to possibly execute arbitrary commands.

    first Mar 3, 2020
  • Unscored
    USN-4290-2 1 CVE

    libpam-radius-auth vulnerability

    USN-4290-1 fixed a vulnerability in libpam-radius-auth. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that libpam-radius-auth incorrectly handled certain long passwords. A…

    first Mar 3, 2020
  • Unscored
    USN-4290-1 1 CVE

    libpam-radius-auth vulnerability

    It was discovered that libpam-radius-auth incorrectly handled certain long passwords. A remote attacker could possibly use this issue to cause libpam-radius-auth to crash, resulting in a denial of service.

    first Feb 24, 2020
  • Unscored
    USN-4289-1 4 CVEs

    squid, squid3 vulnerabilities

    Jeriko One discovered that Squid incorrectly handled memory when connected to an FTP server. A remote attacker could possibly use this issue to obtain sensitive information from Squid memory. (CVE-2019-12528) Regis Leroy discovered that Squid incorrectly hand…

    first Feb 20, 2020
  • Critical max 9.8
    USN-4273-1 1 CVE

    python-reportlab vulnerability

    It was discovered that ReportLab incorrectly handled certain XML documents. If a user or automated system were tricked into processing a specially crafted document, a remote attacker could possibly use this issue to execute arbitrary code.

    first Feb 6, 2020
  • Critical max 9.8
    USN-4268-1 1 CVE 1 exploited

    OpenSMTPD vulnerability

    It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could use this vulnerability to execute arbitrary commands as root.

    first Feb 5, 2020
  • Unscored
    USN-4265-2 2 CVEs

    spamassassin vulnerabilities

    USN-4265-1 fixed several vulnerabilities in SpamAssassin. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM. Original advisory details: It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or autom…

    first Feb 4, 2020
  • Unscored
    USN-4265-1 2 CVEs

    spamassassin vulnerabilities

    It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code.

    first Feb 4, 2020
  • Critical max 9.8
    USN-4264-1 1 CVE

    python-django vulnerability

    Simon Charette discovered that Django incorrectly handled input in the PostgreSQL module. A remote attacker could possibly use this to perform SQL injection attacks.

    first Feb 4, 2020
  • Unscored
    USN-4263-2 1 CVE

    sudo vulnerability

    USN-4263-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Joe Vennix discovered that Sudo incorrectly handled memory operations when the pwfeedback option is e…

    first Feb 5, 2020
  • Unscored
    USN-4263-1 1 CVE

    sudo vulnerability

    Joe Vennix discovered that Sudo incorrectly handled memory operations when the pwfeedback option is enabled. A local attacker could possibly use this issue to obtain unintended access to the administrator account.

    first Feb 3, 2020
  • Critical max 9.8
    USN-4259-1 1 CVE

    Apache Solr vulnerability

    Michael Stepankin and Olga Barinova discovered that Apache Solr was vulnerable to an XXE attack. An attacker could use this vulnerability to remotely execute code.

    first Jan 29, 2020
  • Critical max 9.8
    USN-4252-2 28 CVEs

    tcpdump vulnerabilities

    USN-4252-1 fixed several vulnerabilities in tcpdump. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Multiple security issues were discovered in tcpdump. A remote attacker could use these iss…

    first Jan 27, 2020
  • Critical max 9.8
    USN-4252-1 28 CVEs

    tcpdump vulnerabilities

    Multiple security issues were discovered in tcpdump. A remote attacker could use these issues to cause tcpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Jan 27, 2020
  • High max 7.5
    USN-4245-1 1 CVE

    python-pysaml2 vulnerability

    It was discovered that PySAML2 incorrectly handled certain SAML files. An attacker could possibly use this issue to bypass signature verification with arbitrary data.

    first Jan 21, 2020
  • Unscored
    USN-4242-1 2 CVEs

    sysstat vulnerabilities

    It was discovered that Sysstat incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-16167) It was discovered that Sysstat in…

    first Jan 20, 2020
  • Unscored
    USN-4240-1 1 CVE

    kamailio vulnerability

    It was discovered that Kamailio incorrectly handled a specially crafted file. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

    first Jan 16, 2020
  • Unscored
    USN-4237-2 2 CVEs

    spamassassin vulnerabilities

    USN-4237-1 fixed several vulnerabilities in SpamAssassin. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM. Original advisory details: It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or autom…

    first Jan 15, 2020
  • Unscored
    USN-4237-1 2 CVEs

    spamassassin vulnerabilities

    It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code. (CVE-2018-11805) It was discovered that SpamAssas…

    first Jan 13, 2020
  • Unscored
    USN-4235-2 1 CVE

    nginx vulnerability

    USN-4235-1 fixed a vulnerability in nginx. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain error_page configurations. A …

    first Jan 15, 2020
  • Unscored
    USN-4235-1 1 CVE

    nginx vulnerability

    Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain error_page configurations. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks and access resources contrary to expectations.

    first Jan 13, 2020
  • Unscored
    USN-4229-2 1 CVE

    ntp vulnerability

    USN-4229-1 fixed a vulnerability in NTP. This update provides the corresponding update for Ubuntu 18.04 ESM. Original advisory details: It was discovered that ntpq and ntpdc incorrectly handled some arguments. An attacker could possibly use this issue to caus…

    first Mar 15, 2021
  • Critical max 9.8
    USN-4224-1 1 CVE

    python-django vulnerability

    Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts.

    first Dec 19, 2019
  • Unscored
    USN-4223-1 16 CVEs

    openjdk-8, openjdk-lts vulnerabilities

    Jan Jancar, Petr Svenda, and Vladimir Sedlacek discovered that a side- channel vulnerability existed in the ECDSA implementation in OpenJDK. An Attacker could use this to expose sensitive information. (CVE-2019-2894) It was discovered that the Socket implemen…

    first Dec 17, 2019
  • Unscored
    USN-4220-1 8 CVEs

    git vulnerabilities

    Joern Schneeweisz and Nicolas Joly discovered that Git contained various security flaws. An attacker could possibly use these issues to overwrite arbitrary paths, execute arbitrary code, and overwrite files in the .git directory.

    first Dec 10, 2019
  • Unscored
    USN-4213-1 6 CVEs

    squid, squid3 vulnerabilities

    Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain URN requests. A remote attacker could possibly use this issue to bypass access checks and access restricted servers. This issue was only addressed in Ubuntu 19.04 and Ubunt…

    first Dec 4, 2019
  • Unscored
    USN-4212-1 1 CVE

    haproxy vulnerability

    Tim Düsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to execute arbitrary code through CRLF injection.

    first Dec 4, 2019
  • High max 7.5
    USN-4204-1 1 CVE

    python-psutil vulnerability

    Riccardo Schirone discovered that psutil incorrectly handled certain reference counting operations. An attacker could use this issue to cause psutil to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Nov 28, 2019
  • Unscored
    USN-4200-1 2 CVEs

    redmine vulnerabilities

    It was discovered that Redmine incorrectly handle certain inputs that could cause textile formatting errors. An attacker could possibly use this issue to cause a XSS attack. (CVE-2019-17427) It was discovered that an SQL injection could allow users to access …

    first Nov 26, 2019
  • High max 7.4
    USN-4196-1 2 CVEs

    python-ecdsa vulnerabilities

    It was discovered that python-ecdsa incorrectly handled certain signatures. A remote attacker could possibly use this issue to cause python-ecdsa to generate unexpected exceptions, resulting in a denial of service. (CVE-2019-14853) It was discovered that pyth…

    first Nov 18, 2019
  • Unscored
    USN-4194-2 1 CVE

    postgresql-common vulnerability

    USN-4194-1 fixed a vulnerability in postgresql-common. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Rich Mirch discovered that the postgresql-common pg_ctlcluster script incorrectly handled directory creation.…

    first Dec 3, 2019
  • Unscored
    USN-4194-1 1 CVE

    postgresql-common vulnerability

    Rich Mirch discovered that the postgresql-common pg_ctlcluster script incorrectly handled directory creation. A local attacker could possibly use this issue to escalate privileges.

    first Nov 14, 2019
  • Unscored
    USN-4182-4 0 CVEs

    intel-microcode regression

    USN-4182-2 provided updated Intel Processor Microcode. A regression was discovered that caused some Skylake processors to hang after a warm reboot. This update reverts the microcode for that specific processor family. We apologize for the inconvenience. Origi…

    first Dec 4, 2019