Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,466 results · Feed

  • Unscored
    USN-4016-1 2 CVEs

    vim vulnerabilities

    It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-5953) It was discovered that Vim incorrectly handled certain files. An atta…

    first Jun 11, 2019
  • High max 8.6
    USN-4011-2 2 CVEs

    jinja2 vulnerabilities

    USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possib…

    first Jun 6, 2019
  • High max 8.6
    USN-4011-1 2 CVEs

    jinja2 vulnerabilities

    Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10745) Brian Welch discovered that Jinja incorrectly handled str.format_ma…

    first Jun 6, 2019
  • Unscored
    USN-4007-2 1 CVE

    linux-aws-hwe, linux-hwe, linux-oracle vulnerability

    USN-4007-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Federico Manuel Bento discovered that the Linu…

    first Jun 4, 2019
  • Unscored
    USN-4006-2 1 CVE

    linux-hwe vulnerability

    USN-4006-1 fixed a vulnerability in the Linux kernel for Ubuntu 18.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS. Federico Manuel Bento discovered that the Linux kernel…

    first Jun 4, 2019
  • Unscored
    USN-3996-1 1 CVE

    GNU Screen vulnerability

    Kuang-che Wu discovered that GNU Screen improperly handled certain input. An attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service or the execution of arbitrary code.

    first May 29, 2019
  • Unscored
    USN-3995-2 1 CVE

    keepalived vulnerability

    USN-3995-1 fixed a vulnerability in keepalived. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Keepalived incorrectly handled certain HTTP status response codes. A rem…

    first May 28, 2019
  • Unscored
    USN-3995-1 1 CVE

    keepalived vulnerability

    It was discovered that Keepalived incorrectly handled certain HTTP status response codes. A remote attacker could use this issue to cause Keepalived to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first May 28, 2019
  • Medium max 6.1
    USN-3990-2 1 CVE

    python-urllib3 vulnerability

    USN-3990-1 fixed a vulnerability in urllib3. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this …

    first Jul 29, 2019
  • Medium max 5.9
    USN-3977-3 4 CVEs

    intel-microcode update

    USN-3977-1 and USN-3977-2 provided mitigations for Microarchitectural Data Sampling (MDS) vulnerabilities in Intel Microcode for a large number of Intel processor families. This update provides the corresponding updated microcode mitigations for the Intel San…

    first Jun 20, 2019
  • Unscored
    USN-3975-1 4 CVEs

    openjdk-8, openjdk-lts vulnerabilities

    It was discovered that the BigDecimal implementation in OpenJDK performed excessive computation when given certain values. An attacker could use this to cause a denial of service (excessive CPU usage). (CVE-2019-2602) Corwin de Boor and Robert Xiao discovered…

    first May 13, 2019
  • Unscored
    USN-3974-1 3 CVEs

    VCFtools vulnerabilities

    It was discovered that VCFtools improperly handled certain input. If a user was tricked into opening a crafted input file, VCFtools could be made to crash. (CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)

    first May 13, 2019
  • Unscored
    USN-3969-2 1 CVE

    wpa vulnerability

    USN-3969-1 fixed a vulnerability in wpa_supplicant and hostapd. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that wpa_supplicant and hostapd incorrectly handled unexpected fragments when usin…

    first May 9, 2019
  • Unscored
    USN-3969-1 1 CVE

    wpa vulnerability

    It was discovered that wpa_supplicant and hostapd incorrectly handled unexpected fragments when using EAP-pwd. A remote attacker could possibly use this issue to cause a denial of service.

    first May 7, 2019
  • Medium max 6.4
    USN-3968-3 2 CVEs

    sudo vulnerabilities

    USN-3968-1 fixed several vulnerabilities in Sudo. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications…

    first Sep 28, 2020
  • Unscored
    USN-3968-2 1 CVE

    sudo vulnerability

    USN-3968-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to determine its contr…

    first May 29, 2019
  • Medium max 6.4
    USN-3968-1 2 CVEs

    sudo vulnerabilities

    Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications. A local attacker could possibly use this issue to bypass configured restrictions and execute arbitrary commands. (CVE-2016-7076) It was discove…

    first May 6, 2019
  • Medium max 4.8
    USN-3966-1 1 CVE

    gnome-shell vulnerability

    It was discovered that the GNOME Shell incorrectly handled certain keyboard inputs. An attacker could possibly use this issue to invoke keyboard shortcuts, and potentially other actions while the workstation was locked.

    first May 6, 2019
  • Unscored
    USN-3963-1 1 CVE

    memcached vulnerability

    It was discovered that Memcached incorrectly handled certain lru command messages. A remote attacker could possibly use this issue to cause Memcached to crash, resulting in a denial of service.

    first May 1, 2019
  • Unscored
    USN-3955-1 2 CVEs

    tcpflow vulnerabilities

    It was discovered that tcpflow incorrectly handled certain malformed network packets. A remote attacker could send these packets to a target system, causing tcpflow to crash or possibly disclose sensitive information.

    first Apr 24, 2019
  • Unscored
    USN-3949-1 1 CVE

    openjdk-lts vulnerability

    It was discovered that a memory disclosure issue existed in the OpenJDK Library subsystem. An attacker could use this to expose sensitive information and possibly bypass Java sandbox restrictions. (CVE-2019-2422) Please note that with this update, the OpenJDK…

    first Apr 16, 2019
  • Unscored
    USN-3946-1 3 CVEs

    rssh vulnerabilities

    It was discovered that rssh incorrectly handled certain command-line arguments and environment variables. An authenticated user could bypass rssh's command restrictions, allowing an attacker to run arbitrary commands.

    first Apr 11, 2019
  • Unscored
    USN-3944-1 5 CVEs

    wpa vulnerabilities

    It was discovered that wpa_supplicant and hostapd were vulnerable to a side channel attack against EAP-pwd. A remote attacker could possibly use this issue to recover certain passwords. (CVE-2019-9495) Mathy Vanhoef discovered that wpa_supplicant and hostapd …

    first Apr 10, 2019
  • Unscored
    USN-3943-1 2 CVEs

    wget vulnerabilities

    It was discovered that Wget incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20483) Kusano Kazuhiko discovered that Wget incorr…

    first Apr 8, 2019
  • Unscored
    USN-3942-1 1 CVE

    openjdk-7 vulnerability

    It was discovered that a memory disclosure issue existed in the OpenJDK Library subsystem. An attacker could use this to expose sensitive information and possibly bypass Java sandbox restrictions.

    first Apr 9, 2019
  • Unscored
    USN-3936-1 1 CVE

    advancecomp vulnerability

    It was discovered that AdvanceCOMP incorrectly handled certain PNG files. An attacker could possibly use this issue to execute arbitrary code.

    first Apr 4, 2019
  • High max 8.8
    USN-3935-1 10 CVEs

    busybox vulnerabilities

    Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could overwrite arbitrary files outside of the current director…

    first Apr 3, 2019
  • High max 8.1
    USN-3924-1 2 CVEs

    libapache2-mod-auth-mellon vulnerabilities

    It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. (CVE-2019-3877) It was discovered that mod_auth_mellon incorrectly handled certain requests. An attac…

    first Mar 28, 2019
  • Medium max 5.0
    USN-3923-1 4 CVEs

    qemu vulnerabilities

    Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol (MTP). An attacker inside the guest could use this issue to read or write arbitrary files and cause a denial of service, or possibly execute arbitrary code. This issue onl…

    first Mar 27, 2019
  • Medium max 5.7
    USN-3917-1 1 CVE

    snapd vulnerability

    The snapd default seccomp filter for strict mode snaps blocks the use of the ioctl() system call when used with TIOCSTI as the second argument to the system call. Jann Horn discovered that this restriction could be circumvented on 64 bit architectures. A mali…

    first Mar 21, 2019
  • Unscored
    USN-3913-1 2 CVEs

    p7zip vulnerabilities

    It was discovered that p7zip did not correctly handle certain malformed archives. If a user or automated system were tricked into processing a specially crafted archive with p7zip, then p7zip could be made to crash, possibly leading to abitrary code execution.

    first Mar 21, 2019
  • Unscored
    USN-3907-1 1 CVE

    walinuxagent vulnerability

    It was discovered that WALinuxAgent created swap files with incorrect permissions. A local attacker could possibly use this issue to obtain sensitive information from the swap file.

    first Mar 12, 2019
  • Medium max 5.9
    USN-3903-2 3 CVEs

    linux-hwe, linux-azure vulnerabilities

    USN-3903-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS. Jason Wang discovered that the vhost net driver in the…

    first Mar 6, 2019
  • Unscored
    USN-3901-2 3 CVEs

    linux-hwe, linux-aws-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities

    USN-3901-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Jann Horn discovered that the userfaultd imple…

    first Mar 5, 2019
  • Unscored
    USN-3894-1 1 CVE

    gnome-keyring vulnerability

    It was discovered that GNOME Keyring incorrectly cleared out credentials supplied to the PAM module. A local attacker could possibly use this issue to discover login credentials.

    first Feb 26, 2019
  • High max 7.5
    USN-3890-1 1 CVE

    python-django vulnerability

    It was discovered that Django incorrectly handled formatting certain numbers. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.

    first Feb 13, 2019
  • High max 7.0
    USN-3888-1 1 CVE

    gvfs vulnerability

    It was discovered that GVfs incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information.

    first Feb 12, 2019
  • High max 8.8
    USN-3887-1 1 CVE

    snapd vulnerability

    Chris Moberly discovered that snapd versions 2.28 through 2.37 incorrectly validated and parsed the remote socket address when performing access controls on its UNIX socket. A local attacker could use this to access privileged socket APIs and obtain administr…

    first Feb 12, 2019
  • Medium max 5.9
    USN-3885-2 1 CVE

    openssh vulnerability

    USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix for CVE-2019-6111 turned out to be incomplete. This update fixes the problem. Original advisory details: Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a use…

    first Mar 4, 2019
  • Unscored
    USN-3878-3 0 CVEs

    linux, linux-hwe regression

    USN-3878-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a regression that could prevent systems with certain graphics chipsets from booting. This update fixes the problem. We apologize for the inconvenience. Original adviso…

    first Feb 8, 2019