Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,466 results · Feed

  • High max 7.5
    USN-3090-2 1 CVE

    Pillow regression

    USN-3090-1 fixed vulnerabilities in Pillow. The patch to fix CVE-2014-9601 caused a regression which resulted in failures when processing certain png images. This update temporarily reverts the security fix for CVE-2014-9601 pending further investigation. We …

    first Sep 30, 2016
  • High max 7.5
    USN-3090-1 5 CVEs

    Pillow vulnerabilities

    It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed, potentially leading to a denial of service. (CVE-2014-9601) Andrew Drake discovered that Pillow incorrectly valida…

    first Sep 27, 2016
  • High max 7.5
    USN-3089-1 1 CVE

    python-django vulnerability

    Sergey Bobrov discovered that Django incorrectly parsed cookies when being used with Google Analytics. A remote attacker could possibly use this issue to set arbitrary cookies leading to a CSRF protection bypass.

    first Sep 27, 2016
  • Unscored
    USN-3084-4 3 CVEs

    linux-snapdragon vulnerabilities

    Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker could use this to corrupt audit logs or disrupt system-call auditing. (CVE-2016-6136) It was discovered that the powerpc and powerpc64 hypervisor-mode KVM im…

    first Sep 19, 2016
  • Unscored
    USN-3084-3 3 CVEs

    linux-raspi2 vulnerabilities

    Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker could use this to corrupt audit logs or disrupt system-call auditing. (CVE-2016-6136) It was discovered that the powerpc and powerpc64 hypervisor-mode KVM im…

    first Sep 19, 2016
  • Unscored
    USN-3084-2 3 CVEs

    linux-lts-xenial vulnerabilities

    USN-3084-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Pengfei Wang discovered a race condition in th…

    first Sep 19, 2016
  • Unscored
    USN-3081-2 1 CVE

    tomcat6 vulnerability

    Dawid Golunski discovered that the Tomcat init script incorrectly handled creating log files. A remote attacker could possibly use this issue to obtain root privileges.

    first Oct 27, 2020
  • Unscored
    USN-3081-1 1 CVE

    tomcat6, tomcat7, tomcat8 vulnerability

    Dawid Golunski discovered that the Tomcat init script incorrectly handled creating log files. A remote attacker could possibly use this issue to obtain root privileges. (CVE-2016-1240) This update also reverts a change in behaviour introduced in USN-3024-1 by…

    first Sep 19, 2016
  • Unscored
    USN-3074-1 1 CVE

    file-roller vulnerability

    It was discovered that File Roller incorrectly handled symlinks. If a user were tricked into extracting a specially-crafted archive, an attacker could delete files outside of the extraction directory.

    first Sep 8, 2016
  • Unscored
    USN-3070-4 8 CVEs

    linux-lts-xenial vulnerabilities

    USN-3070-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. A missing permission check when settings ACLs …

    first Aug 30, 2016
  • Unscored
    USN-3070-3 8 CVEs

    linux-snapdragon vulnerabilities

    A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw to gain access to any file by setting an ACL. (CVE-2016-1237) Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implement…

    first Aug 30, 2016
  • Unscored
    USN-3070-2 8 CVEs

    linux-raspi2 vulnerabilities

    A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw to gain access to any file by setting an ACL. (CVE-2016-1237) Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implement…

    first Aug 30, 2016
  • Unscored
    USN-3064-1 1 CVE

    gnupg vulnerability

    Felix Dörre and Vladimir Klebanov discovered that GnuPG incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits from the RNG can trivially predict the next 160 bits of output.

    first Aug 18, 2016
  • Unscored
    USN-3062-1 7 CVEs

    openjdk-7 vulnerabilities

    Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service, expose sensitive data over the network, or possibly execute arbitrar…

    first Aug 16, 2016
  • Unscored
    USN-3057-1 4 CVEs

    linux-snapdragon vulnerabilities

    Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative…

    first Aug 10, 2016
  • Unscored
    USN-3056-1 4 CVEs

    linux-raspi2 vulnerabilities

    Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative…

    first Aug 10, 2016
  • Unscored
    USN-3054-1 4 CVEs

    linux-lts-xenial vulnerabilities

    Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative…

    first Aug 10, 2016
  • Unscored
    USN-3053-1 4 CVEs

    linux-lts-vivid vulnerabilities

    A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw to gain access to any file by setting an ACL. (CVE-2016-1237) It was discovered that the keyring implementation in the Linux kernel did not ensure a dat…

    first Aug 10, 2016
  • Unscored
    USN-3047-2 0 CVEs

    qemu, qemu-kvm regression

    USN-3047-1 fixed vulnerabilities in QEMU. The patch to fix CVE-2016-5403 caused a regression which resulted in save/restore failures when virtio memory balloon statistics are enabled. This update temporarily reverts the security fix for CVE-2016-5403 pending …

    first Aug 12, 2016
  • Unscored
    USN-3047-1 14 CVEs

    qemu, qemu-kvm vulnerabilities

    Li Qiang discovered that QEMU incorrectly handled 53C9X Fast SCSI controller emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In th…

    first Aug 4, 2016
  • Unscored
    USN-3043-1 8 CVEs

    openjdk-8 vulnerabilities

    Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service, expose sensitive data over the network, or possibly execute arbitrar…

    first Jul 27, 2016
  • Medium max 6.1
    USN-3039-1 1 CVE

    python-django vulnerability

    It was discovered that Django incorrectly handled the admin's add/change related popup. A remote attacker could possibly use this issue to perform a cross-site scripting attack.

    first Jul 19, 2016
  • Unscored
    USN-3037-1 1 CVE

    linux-lts-vivid vulnerability

    Jan Stancek discovered that the Linux kernel's memory manager did not properly handle moving pages mapped by the asynchronous I/O (AIO) ring buffer to the other nodes. A local attacker could use this to cause a denial of service (system crash).

    first Jul 14, 2016
  • Unscored
    USN-3036-1 1 CVE

    linux-lts-utopic vulnerability

    Jan Stancek discovered that the Linux kernel's memory manager did not properly handle moving pages mapped by the asynchronous I/O (AIO) ring buffer to the other nodes. A local attacker could use this to cause a denial of service (system crash).

    first Jul 14, 2016
  • Unscored
    USN-3035-3 1 CVE

    linux-lts-wily vulnerability

    USN-3035-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS. Jan Stancek discovered that the Linux kernel's memory …

    first Jul 14, 2016
  • Unscored
    USN-3020-1 8 CVEs

    linux-lts-vivid vulnerabilities

    Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denia…

    first Jun 27, 2016
  • Unscored
    USN-3019-1 8 CVEs

    linux-lts-utopic vulnerabilities

    Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denia…

    first Jun 27, 2016
  • Unscored
    USN-3017-3 8 CVEs

    linux-lts-wily vulnerabilities

    USN-3017-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS. Jesse Hertz and Tim Newsham discovered that the Linux …

    first Jun 27, 2016
  • Unscored
    USN-3016-4 8 CVEs

    linux-lts-xenial vulnerabilities

    USN-3016-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jesse Hertz and Tim Newsham discovered that th…

    first Jun 27, 2016
  • Unscored
    USN-3016-3 8 CVEs

    linux-snapdragon vulnerabilities

    Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denia…

    first Jun 27, 2016
  • Unscored
    USN-3016-2 8 CVEs

    linux-raspi2 vulnerabilities

    Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denia…

    first Jun 27, 2016
  • Unscored
    USN-3012-1 1 CVE

    wget vulnerability

    Dawid Golunski discovered that Wget incorrectly handled filenames when being redirected from an HTTP to an FTP URL. A malicious server could possibly use this issue to overwrite local files.

    first Jun 20, 2016
  • Unscored
    USN-3011-1 1 CVE

    haproxy vulnerability

    Falco Schmutz discovered that HAProxy incorrectly handled the reqdeny filter. A remote attacker could use this issue to cause HAProxy to crash, resulting in a denial of service.

    first Jun 20, 2016
  • Unscored
    USN-3009-1 1 CVE

    dnsmasq vulnerability

    Edwin Török discovered that Dnsmasq incorrectly handled certain CNAME responses. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service.

    first Jun 20, 2016
  • Unscored
    USN-3008-1 1 CVE

    linux-snapdragon vulnerability

    Jann Horn discovered that eCryptfs improperly attempted to use the mmap() handler of a lower filesystem that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could use to cause a denial of service (system crash) or…

    first Jun 10, 2016
  • Unscored
    USN-3007-1 10 CVEs

    linux-raspi2 vulnerabilities

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117) Jann Horn discovered th…

    first Jun 10, 2016
  • Unscored
    USN-3005-1 10 CVEs

    linux-lts-xenial vulnerabilities

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117) Jann Horn discovered th…

    first Jun 10, 2016
  • Unscored
    USN-3002-1 12 CVEs

    linux-lts-wily vulnerabilities

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117) Jann Horn discovered th…

    first Jun 10, 2016
  • Unscored
    USN-3001-1 12 CVEs

    linux-lts-vivid vulnerabilities

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117) Jann Horn discovered th…

    first Jun 10, 2016
  • Unscored
    USN-3000-1 14 CVEs

    linux-lts-utopic vulnerabilities

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117) Jann Horn discovered th…

    first Jun 10, 2016