Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,466 results · Feed

  • Unscored
    USN-3632-1 15 CVEs

    linux-azure vulnerabilities

    It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-…

    first Apr 24, 2018
  • Unscored
    USN-3631-2 5 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3631-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a buffer overread vulne…

    first Apr 24, 2018
  • Unscored
    USN-3630-2 1 CVE

    linux-hwe, linux-gcp, linux-oem vulnerability

    USN-3630-1 fixed a vulnerability in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. It was discovered that the Broadcom UniMAC MDIO bus co…

    first Apr 24, 2018
  • Unscored
    USN-3624-1 3 CVEs

    patch vulnerabilities

    It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2016-10713) It was discovered that Patch incorrectly handled certain input validation. An attacker could possibly use this t…

    first Apr 10, 2018
  • Unscored
    USN-3623-1 0 CVEs

    ubuntu-release-upgrader vulnerability

    It was discovered that ubuntu-release-upgrader did not correctly drop permissions before opening a browser to view the release notes. This update fixes the issue.

    first Apr 9, 2018
  • Medium max 5.5
    USN-3619-2 39 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3619-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jann Horn discovered that the Berkeley Packet …

    first Apr 5, 2018
  • Unscored
    USN-3617-2 22 CVEs

    linux-hwe, linux-gcp, linux-oem vulnerabilities

    USN-3617-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. It was discovered that a race condition leading to a u…

    first Apr 3, 2018
  • High max 7.5
    USN-3616-1 1 CVE

    python-crypto vulnerability

    It was discovered that Python Crypto incorrectly generated ElGamal key parameters. A remote attacker could possibly use this issue to obtain sensitive information.

    first Apr 3, 2018
  • Unscored
    USN-3614-1 14 CVEs

    openjdk-7 vulnerabilities

    It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker could possibly use this to expose sensitive information. (CVE-2018-2579) It was discovered that the LDAP implementation in OpenJDK did not properly enco…

    first Apr 2, 2018
  • Unscored
    USN-3613-1 15 CVEs

    openjdk-8 vulnerabilities

    It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker could possibly use this to expose sensitive information. (CVE-2018-2579) It was discovered that the Hotspot component of OpenJDK did not properly valida…

    first Apr 2, 2018
  • Unscored
    USN-3607-1 1 CVE

    screen-resolution-extra vulnerability

    It was discovered that Screen Resolution Extra was using PolicyKit in an unsafe manner. A local attacker could potentially exploit this issue to bypass intended PolicyKit authorizations.

    first Mar 26, 2018
  • Unscored
    USN-3605-1 1 CVE

    sharutils vulnerability

    It was discovered that Sharutils incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code.

    first Mar 22, 2018
  • Critical max 9.8
    USN-3603-1 1 CVE

    paramiko vulnerability

    Matthijs Kooijman discovered that Paramiko's SSH server implementation did not properly require authentication before processing requests. An unauthenticated remote attacker could possibly use this to execute arbitrary code.

    first Mar 20, 2018
  • Unscored
    USN-3601-1 1 CVE

    memcached vulnerability

    It was discovered that Memcached incorrectly handled reusing certain items. A remote attacker could possibly use this issue to cause Memcached to crash, resulting in a denial of service.

    first Mar 19, 2018
  • Medium max 5.6
    USN-3597-2 3 CVEs

    linux-hwe vulnerabilities

    USN-3597-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. USNS 3541-2 and 3523-2 provided mitigations for Spectr…

    first Mar 15, 2018
  • Medium max 5.3
    USN-3591-1 2 CVEs

    python-django vulnerabilities

    James Davis discovered that Django incorrectly handled certain template filters. A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service.

    first Mar 6, 2018
  • Unscored
    USN-3588-1 2 CVEs

    memcached vulnerabilities

    Daniel Shapira discovered an integer overflow issue in Memcached. A remote attacker could use this to cause a denial of service (daemon crash). (CVE-2017-9951) It was discovered that Memcached listened to UDP by default. A remote attacker could use this as pa…

    first Mar 5, 2018
  • Medium max 5.3
    USN-3585-1 1 CVE

    twisted vulnerability

    It was discovered that Twisted incorrectly handled certain HTTP requests. An attacker could possibly use this issue to execute arbitrary code.

    first Mar 5, 2018
  • Unscored
    USN-3584-1 1 CVE

    sensible-utils vulnerability

    Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker could possibly use this issue with a specially crafted URL to conduct an argument injection attack and execut…

    first Feb 26, 2018
  • Medium max 5.6
    USN-3582-2 6 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3582-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Mohamed Ghannam discovered that the IPv4 raw s…

    first Feb 22, 2018
  • Medium max 5.6
    USN-3581-2 4 CVEs

    linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities

    USN-3581-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. Mohamed Ghannam discovered that the IPv4 raw socket im…

    first Feb 22, 2018
  • Unscored
    USN-3575-2 0 CVEs

    qemu regression

    USN-3575-1 fixed vulnerabilities in QEMU. The fix for CVE-2017-11334 caused a regression in Xen environments. This update removes the problematic fix pending further investigation. We apologize for the inconvenience. Original advisory details: It was discover…

    first Mar 5, 2018
  • Medium max 5.8
    USN-3575-1 11 CVEs

    qemu vulnerabilities

    It was discovered that QEMU incorrectly handled guest ram. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-11334) D…

    first Feb 20, 2018
  • High max 7.5
    USN-3573-1 3 CVEs

    quagga vulnerabilities

    It was discovered that a double-free vulnerability existed in the Quagga BGP daemon when processing certain forms of UPDATE message. A remote attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2018-5379) It was disco…

    first Feb 16, 2018
  • Low max 3.3
    USN-3570-1 1 CVE

    advancecomp vulnerability

    Joonun Jang discovered that AdvanceCOMP incorrectly handled certain malformed zip files. If a user or automated system were tricked into processing a specially crafted zip file, a remote attacker could cause AdvanceCOMP to crash, resulting in a denial of serv…

    first Feb 14, 2018
  • Medium max 5.5
    USN-3567-1 1 CVE

    puppet vulnerability

    It was discovered that Puppet incorrectly handled permissions when unpacking certain tarballs. A local user could possibly use this issue to execute arbitrary code.

    first Feb 12, 2018
  • Unscored
    USN-3563-1 1 CVE

    mailman vulnerability

    It was discovered that Mailman incorrectly handled certain web scripts. An attacker could possibly use this to inject arbitrary code.

    first Feb 8, 2018
  • Medium max 5.6
    USN-3560-1 1 CVE

    qemu update

    It was discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. An attacker in the guest could use this to expose sensitive guest informat…

    first Feb 7, 2018
  • Unscored
    USN-3557-1 6 CVEs

    squid3 vulnerabilities

    Mathias Fischer discovered that Squid incorrectly handled certain long strings in headers. A malicious remote server could possibly cause Squid to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2016-2569) Will…

    first Feb 5, 2018
  • Unscored
    USN-3555-1 3 CVEs

    w3m vulnerabilities

    It was discovered that w3m incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. (CVE-2018-6196, CVE-2018-6197) It was discovered that w3m incorrectly handled temporary files. An attacker could possibly use this…

    first Feb 1, 2018
  • Unscored
    USN-3548-2 0 CVEs

    linux-hwe, linux-azure, linux-gcp, linux-oem vulnerability

    USN-3548-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. Jay Vosburgh discovered a logic error in the x86-64 sy…

    first Jan 26, 2018
  • Unscored
    USN-3543-1 2 CVEs

    rsync vulnerabilities

    It was discovered that rsync incorrectly handled certain data input. An attacker could possibly use this to cause a denial of service or execute arbitrary code. (CVE-2017-16548) It was discovered that rsync incorrectly parsed certain arguments. An attacker co…

    first Jan 23, 2018
  • Unscored
    USN-3533-1 1 CVE

    transmission vulnerability

    It was discovered that Transmission incorrectly handled certain POST requests to the RPC server and allowed DNS rebinding attack. An attacker could possibly use this issue to execute arbitrary code.

    first Jan 16, 2018
  • Medium max 5.6
    USN-3531-3 1 CVE

    intel-microcode update

    Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, includ…

    first Mar 29, 2018
  • Unscored
    USN-3531-2 0 CVEs

    intel-microcode regression

    USN-3531-1 updated Intel microcode to the 20180108 release. Regressions were discovered in the microcode updates which could cause system instability on certain hardware platforms. At the request of Intel, we have reverted to the previous packaged microcode v…

    first Jan 22, 2018
  • Medium max 5.6
    USN-3531-1 1 CVE

    intel-microcode update

    It was discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including…

    first Jan 11, 2018
  • Unscored
    USN-3522-4 0 CVEs

    linux-lts-xenial regression

    USN-3522-2 fixed a vulnerability in the Linux Hardware Enablement kernel for Ubuntu 14.04 LTS to address Meltdown (CVE-2017-5754). Unfortunately, that update introduced a regression where a few systems failed to boot successfully. This update fixes the proble…

    first Jan 10, 2018
  • High max 8.1
    USN-3520-1 1 CVE

    python-pysaml2 vulnerability

    It was discovered that PySAML2 incorrectly accepted any password when run with python optimizations enabled. An attacker could use this issue to authenticate as any user without a valid password.

    first Jan 8, 2018
  • Unscored
    USN-3518-1 1 CVE

    awstats vulnerability

    It was discovered that AWStats incorrectly filtered certain parameters. A remote attacker could possibly use this issue to execute arbitrary code.

    first Jan 8, 2018
  • Unscored
    USN-3511-1 2 CVEs

    linux-azure vulnerabilities

    Mohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16939) It was…

    first Dec 8, 2017