Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,466 results · Feed

  • Unscored
    USN-3875-1 1 CVE

    openjdk-8, openjdk-lts vulnerability

    It was discovered that a memory disclosure issue existed in the OpenJDK Library subsystem. An attacker could use this to expose sensitive information and possibly bypass Java sandbox restrictions. (CVE-2019-2422)

    first Jan 30, 2019
  • Unscored
    USN-3873-1 3 CVEs

    openvswitch vulnerabilities

    It was discovered that Open vSwitch incorrectly decoded certain packets. A remote attacker could possibly use this issue to cause Open vSwitch to crash, resulting in a denial of service. (CVE-2018-17204) It was discovered that Open vSwitch incorrectly handled…

    first Jan 30, 2019
  • Medium max 6.1
    USN-3872-1 4 CVEs

    linux-hwe vulnerabilities

    It was discovered that a race condition existed in the vsock address family implementation of the Linux kernel that could lead to a use-after-free condition. A local attacker in a guest virtual machine could use this to expose sensitive information (host mach…

    first Jan 29, 2019
  • High max 7.3
    USN-3871-5 13 CVEs

    linux-azure vulnerabilities

    Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possi…

    first Feb 7, 2019
  • High max 7.3
    USN-3871-4 13 CVEs

    linux-hwe, linux-aws-hwe, linux-gcp vulnerabilities

    USN-3871-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Wen Xu discovered that a use-after-free vulner…

    first Feb 4, 2019
  • High max 7.3
    USN-3871-3 13 CVEs

    linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities

    Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possi…

    first Feb 4, 2019
  • Unscored
    USN-3858-1 3 CVEs

    haproxy vulnerabilities

    It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this to expose sensitive information. (CVE-2018-20102) It was discovered that HAProxy incorrectly handled certain requests. A attacker could possibly use this …

    first Jan 15, 2019
  • High max 8.8
    USN-3857-1 1 CVE

    php-pear vulnerability

    Fariskhi Vidyan discovered that PEAR Archive_Tar incorrectly handled certain archive paths. A remote attacker could possibly use this issue to execute arbitrary code.

    first Jan 14, 2019
  • Unscored
    USN-3853-1 1 CVE

    gnupg2 vulnerability

    Ben Fuhrmannek discovered that GnuPG incorrectly handled Web Key Directory lookups. A remote attacker could possibly use this issue to cause a denial of service, or perform Cross-Site Request Forgery attacks.

    first Jan 10, 2019
  • Medium max 6.5
    USN-3851-1 1 CVE

    python-django vulnerability

    It was discovered that Django incorrectly handled the default 404 page. A remote attacker could use this issue to spoof content using a malicious URL.

    first Jan 9, 2019
  • Unscored
    USN-3848-2 4 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3848-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a double free existed i…

    first Dec 20, 2018
  • High max 7.8
    USN-3847-3 7 CVEs

    linux-azure vulnerabilities

    USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux kernel for Microsoft Azure Cloud systems for Ubuntu 14.04 LTS. It was discovered that a race condition existed in the raw M…

    first Dec 20, 2018
  • High max 7.8
    USN-3847-2 7 CVEs

    linux-hwe, linux-aws-hwe, linux-azure, linux-gcp vulnerabilities

    USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. It was discovered that a race condition existe…

    first Dec 20, 2018
  • Medium max 6.1
    USN-3841-1 1 CVE

    lxml vulnerability

    It was discovered that lxml incorrectly handled certain HTML files. An attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks.

    first Dec 10, 2018
  • Unscored
    USN-3836-2 2 CVEs

    linux-hwe, linux-gcp vulnerabilities

    USN-3836-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Jann Horn discovered that the Linux kernel mis…

    first Dec 4, 2018
  • Unscored
    USN-3833-1 2 CVEs

    linux-aws vulnerabilities

    Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. (CVE-2018-18955) Philipp Wendler di…

    first Nov 30, 2018
  • Unscored
    USN-3830-1 0 CVEs

    openjdk-8, openjdk-lts regression

    USN-3804-1 fixed vulnerabilities in OpenJDK. Unfortunately, that update introduced a regression when validating JAR files that prevented Java applications from finding classes in some situations. This update fixes the problem. We apologize for the inconvenien…

    first Nov 28, 2018
  • Unscored
    USN-3829-1 2 CVEs

    git vulnerabilities

    It was discovered that Git incorrectly handled layers of tree objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-15298) It was discovered that Git incorrec…

    first Nov 27, 2018
  • Unscored
    USN-3824-1 5 CVEs

    openjdk-7 vulnerabilities

    It was discovered that the Security component of OpenJDK did not properly ensure that manifest elements were signed before use. An attacker could possibly use this to specially construct an untrusted Java application or applet that could escape sandbox restri…

    first Nov 16, 2018
  • Unscored
    USN-3820-3 4 CVEs

    linux-azure vulnerabilities

    Felix Wilhelm discovered that the Xen netback driver in the Linux kernel did not properly perform input validation in some situations. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-15471) …

    first Nov 14, 2018
  • Unscored
    USN-3820-2 4 CVEs

    linux-hwe, linux-azure, linux-gcp vulnerabilities

    USN-3820-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Felix Wilhelm discovered that the Xen netback …

    first Nov 14, 2018
  • High max 8.1
    USN-3813-1 2 CVEs

    pyopenssl vulnerabilities

    It was discovered that pyOpenSSL incorrectly handled memory when handling X509 objects. A remote attacker could use this issue to cause pyOpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-1000807) It was discove…

    first Nov 8, 2018
  • High max 8.2
    USN-3812-1 3 CVEs

    nginx vulnerabilities

    It was discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause excessive memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and …

    first Nov 7, 2018
  • Unscored
    USN-3811-1 3 CVEs

    spamassassin vulnerabilities

    It was discovered that SpamAssassin incorrectly handled certain unclosed tags in emails. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2017-15705) It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin.…

    first Nov 6, 2018
  • Unscored
    USN-3809-2 0 CVEs

    openssh regression

    USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473 was incomplete and could introduce a regression in certain environments. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Robert Swiecki di…

    first Aug 12, 2021
  • Unscored
    USN-3804-1 8 CVEs

    openjdk-8, openjdk-lts vulnerabilities

    It was discovered that the Security component of OpenJDK did not properly ensure that manifest elements were signed before use. An attacker could possibly use this to specially construct an untrusted Java application or applet that could escape sandbox restri…

    first Oct 30, 2018
  • Unscored
    USN-3797-2 4 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3797-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Noam Rathaus discovered that a use-after-free …

    first Oct 23, 2018
  • High max 8.8
    USN-3796-1 1 CVE

    paramiko vulnerability

    Daniel Hoffman discovered that Paramiko incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.

    first Oct 17, 2018
  • Medium max 6.1
    USN-3794-1 1 CVE

    moin vulnerability

    It was discovered that MoinMoin incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information.

    first Oct 16, 2018
  • Unscored
    USN-3791-1 1 CVE

    git vulnerability

    It was discovered that git did not properly validate git submodule urls or paths. A remote attacker could possibly use this to craft a git repository that causes arbitrary code execution when recursive operations are used.

    first Oct 12, 2018
  • High max 7.5
    USN-3780-1 1 CVE

    haproxy vulnerability

    It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service.

    first Oct 2, 2018
  • High max 7.0
    USN-3777-2 7 CVEs

    linux-hwe, linux-gcp vulnerabilities

    USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. Jann Horn discovered that the vmacache subsyst…

    first Oct 1, 2018
  • High max 7.8
    USN-3776-2 9 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3776-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jann Horn discovered that the vmacache subsyst…

    first Oct 1, 2018
  • Unscored
    USN-3774-1 1 CVE

    strongswan vulnerability

    It was discovered that strongSwan incorrectly handled signature validation in the gmp plugin. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly execute arbitrary code.

    first Oct 1, 2018
  • High max 7.5
    USN-3771-1 4 CVEs

    strongswan vulnerabilities

    It was discovered that strongSwan incorrectly handled IKEv2 key derivation. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2018-10811) Sze Yiu Chau discovered that strongSwan incorrectly ha…

    first Sep 25, 2018
  • Low max 2.3
    USN-3762-2 2 CVEs

    linux-hwe, linux-azure, linux-gcp vulnerabilities

    USN-3762-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS. It was discovered that the VirtIO subsystem in…

    first Sep 11, 2018
  • High max 7.3
    USN-3753-2 11 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3753-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the generic SCSI driver…

    first Aug 24, 2018
  • Unscored
    USN-3748-1 1 CVE

    base-files vulnerability

    Sander Bos discovered that the MOTD update script incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.

    first Aug 21, 2018
  • Unscored
    USN-3747-2 0 CVEs

    openjdk-lts regression

    USN-3747-1 fixed vulnerabilities in OpenJDK 10 for Ubuntu 18.04 LTS. Unfortunately, that update introduced a regression around accessability support that prevented some Java applications from starting. This update fixes the problem. We apologize for the incon…

    first Sep 12, 2018
  • High max 8.3
    USN-3747-1 4 CVEs

    openjdk-lts vulnerabilities

    It was discovered that OpenJDK did not properly validate types in some situations. An attacker could use this to construct a Java class that could possibly bypass sandbox restrictions. (CVE-2018-2825, CVE-2018-2826) It was discovered that the PatternSyntaxExc…

    first Aug 21, 2018