Ubuntu Security Notices (USN)

8,466 results · Feed

• Unscored
  USN-2910-1 7 CVEs

  linux-lts-vivid vulnerabilities

  halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged attacker could use this to gain privileges. (CVE-2016-1576) halfdog discovered that OverlayFS in the Linux …

  Feb 10, 2026

  first Feb 22, 2016
• Unscored
  USN-2909-2 0 CVEs

  linux-lts-utopic regression

  USN-2909-1 fixed vulnerabilities in the Ubuntu 14.10 Linux kernel backported to Ubuntu 14.04 LTS. An incorrect locking fix caused a regression that broke graphics displays for Ubuntu 14.04 LTS guests running the Ubuntu 14.10 backport kernel within VMWare virt…

  Feb 10, 2026

  first Feb 27, 2016
• Unscored
  USN-2909-1 3 CVEs

  linux-lts-utopic vulnerabilities

  halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged attacker could use this to gain privileges. (CVE-2016-1576) halfdog discovered that OverlayFS in the Linux …

  Feb 10, 2026

  first Feb 22, 2016
• Unscored
  USN-2908-5 0 CVEs

  linux-lts-wily regression

  USN-2908-2 fixed vulnerabilities in the Ubuntu 15.10 Linux kernel backported to Ubuntu 14.04 LTS. An incorrect locking fix caused a regression that broke graphics displays for Ubuntu 14.04 LTS guests running the Ubuntu 15.10 backport kernel within VMWare virt…

  Feb 10, 2026

  first Feb 27, 2016
• Unscored
  USN-2908-2 5 CVEs

  linux-lts-wily vulnerabilities

  halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged attacker could use this to gain privileges. (CVE-2016-1576) halfdog discovered that OverlayFS in the Linux …

  Feb 10, 2026

  first Feb 22, 2016
• Unscored
  USN-2906-1 2 CVEs

  cpio vulnerabilities

  Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic links when used with the --no-absolute-filenames option. If a user or automated system were tricked into extracting a specially-crafted cpio archive, a remote attacker could possibly u…

  Feb 10, 2026

  first Feb 22, 2016
• Unscored
  USN-2905-1 1 CVE

  oxide-qt vulnerability

  A security issue was discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions or a sandbox protection mechanism. (CVE-2016-1629)

  Feb 10, 2026

  first Feb 23, 2016
• Unscored
  USN-2901-1 1 CVE

  xdelta3 vulnerability

  It was discovered that xdelta3 incorrectly handled certain files. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could use this issue to cause xdelta3 to crash, resulting in a denial of service, or possi…

  Feb 10, 2026

  first Feb 17, 2016
• Unscored
  USN-2895-1 2 CVEs

  oxide-qt vulnerabilities

  The DOM implementation in Chromium did not properly restrict frame-attach operations from occurring during or after frame-detach operations. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass…

  Feb 10, 2026

  first Feb 18, 2016
• Unscored
  USN-2892-1 3 CVEs

  nginx vulnerabilities

  It was discovered that nginx incorrectly handled certain DNS server responses when the resolver is enabled. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2016-0742) It was discovered that nginx…

  Feb 10, 2026

  first Feb 9, 2016
• Unscored
  USN-2890-2 9 CVEs

  linux-lts-wily vulnerabilities

  It was discovered that a use-after-free vulnerability existed in the AF_UNIX implementation in the Linux kernel. A local attacker could use crafted epoll_ctl calls to cause a denial of service (system crash) or expose sensitive information. (CVE-2013-7446) It…

  Feb 10, 2026

  first Feb 2, 2016
• Unscored
  USN-2889-2 5 CVEs

  linux-lts-vivid vulnerabilities

  It was discovered that a use-after-free vulnerability existed in the AF_UNIX implementation in the Linux kernel. A local attacker could use crafted epoll_ctl calls to cause a denial of service (system crash) or expose sensitive information. (CVE-2013-7446) It…

  Feb 10, 2026

  first Feb 2, 2016
• Unscored
  USN-2888-1 8 CVEs

  linux-lts-utopic vulnerabilities

  It was discovered that a use-after-free vulnerability existed in the AF_UNIX implementation in the Linux kernel. A local attacker could use crafted epoll_ctl calls to cause a denial of service (system crash) or expose sensitive information. (CVE-2013-7446) It…

  Feb 10, 2026

  first Feb 2, 2016
• Unscored
  USN-2884-1 6 CVEs

  openjdk-7 vulnerabilities

  Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service, expose sensitive data over the network, or possibly execute arbitrar…

  Feb 10, 2026

  first Feb 1, 2016
• Unscored
  USN-2879-1 1 CVE

  rsync vulnerability

  It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination directory.

  Feb 10, 2026

  first Jan 21, 2016
• Unscored
  USN-2877-1 7 CVEs

  oxide-qt vulnerabilities

  A bad cast was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render…

  Feb 10, 2026

  first Jan 27, 2016
• Unscored
  USN-2873-1 1 CVE

  linux-lts-utopic vulnerability

  Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbi…

  Feb 10, 2026

  first Jan 19, 2016
• Unscored
  USN-2872-2 1 CVE

  linux-lts-wily vulnerability

  Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbi…

  Feb 10, 2026

  first Jan 19, 2016
• Unscored
  USN-2871-2 1 CVE

  linux-lts-vivid vulnerability

  Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbi…

  Feb 10, 2026

  first Jan 19, 2016
• Critical max 9.0
  USN-2862-1 1 CVE

  pygments vulnerability

  It was discovered that Pygments incorrectly sanitized strings used to search system fonts. An attacker could possibly use this issue to execute arbitrary code.

  Feb 10, 2026

  first Jan 7, 2016
• Unscored
  USN-2860-1 5 CVEs

  oxide-qt vulnerabilities

  A race condition was discovered in the MutationObserver implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary…

  Feb 10, 2026

  first Jan 11, 2016
• Unscored
  USN-2858-2 1 CVE

  linux-lts-wily vulnerability

  Nathan Williams discovered that overlayfs in the Linux kernel incorrectly handled setattr operations. A local unprivileged attacker could use this to create files with administrative permission attributes and execute arbitrary code with elevated privileges.

  Feb 10, 2026

  first Jan 5, 2016
• Unscored
  USN-2857-2 1 CVE

  linux-lts-vivid vulnerability

  Nathan Williams discovered that overlayfs in the Linux kernel incorrectly handled setattr operations. A local unprivileged attacker could use this to create files with administrative permission attributes and execute arbitrary code with elevated privileges.

  Feb 10, 2026

  first Jan 5, 2016
• High max 7.8
  USN-2845-1 2 CVEs

  sosreport vulnerabilities

  Dolev Farhi discovered an information disclosure issue in SoS. If the /etc/fstab file contained passwords, the passwords were included in the SoS report. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-3925) Mateusz Guzik discovered that SoS incorrectly …

  Feb 10, 2026

  first Dec 18, 2015
• High max 7.4
  USN-2836-1 1 CVE

  grub2 vulnerability

  Hector Marco and Ismael Ripoll discovered that GRUB incorrectly handled the backspace key when configured to use authentication. A local attacker could use this issue to bypass GRUB password protection.

  Feb 10, 2026

  first Dec 15, 2015
• Unscored
  USN-2835-1 1 CVE

  git vulnerability

  Blake Burkhart discovered that the Git git-remote-ext helper incorrectly handled recursive clones of git repositories. A remote attacker could possibly use this issue to execute arbitrary code by injecting commands via crafted URLs.

  Feb 10, 2026

  first Dec 15, 2015
• Unscored
  USN-2829-2 2 CVEs

  linux-lts-vivid vulnerabilities

  It was discovered that the SCTP protocol implementation in the Linux kernel performed an incorrect sequence of protocol-initialization steps. A local attacker could use this to cause a denial of service (system crash). (CVE-2015-5283) Dmitry Vyukov discovered…

  Feb 10, 2026

  first Dec 4, 2015
• Unscored
  USN-2828-1 4 CVEs

  qemu, qemu-kvm vulnerabilities

  Jason Wang discovered that QEMU incorrectly handled the virtio-net device. A remote attacker could use this issue to cause guest network consumption, resulting in a denial of service. (CVE-2015-7295) Qinghao Tang and Ling Liu discovered that QEMU incorrectly …

  Feb 10, 2026

  first Dec 3, 2015
• Unscored
  USN-2825-1 16 CVEs

  oxide-qt vulnerabilities

  Multiple use-after-free bugs were discovered in the application cache implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash,…

  Feb 10, 2026

  first Dec 10, 2015
• Unscored
  USN-2824-1 1 CVE

  linux-lts-utopic vulnerability

  Dmitry Vyukov discovered that the Linux kernel's keyring handler attempted to garbage collect incompletely instantiated keys. A local unprivileged attacker could use this to cause a denial of service (system crash).

  Feb 10, 2026

  first Dec 1, 2015
• Unscored
  USN-2818-1 1 CVE

  openjdk-7 vulnerability

  It was discovered that rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed. Am attacker could use this to expose sensitive information or possibly execute arbitrary code.

  Feb 10, 2026

  first Nov 25, 2015
• Unscored
  USN-2817-1 2 CVEs

  icedtea-web vulnerabilities

  It was discovered that IcedTea Web incorrectly handled applet URLs. A remote attacker could possibly use this issue to inject applets into the .appletTrustSettings configuration file and bypass user approval. (CVE-2015-5234) Andrea Palazzo discovered that Ice…

  Feb 10, 2026

  first Nov 24, 2015
• Low max 2.8
  USN-2816-1 1 CVE

  python-django vulnerability

  Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from application settings.

  Feb 10, 2026

  first Nov 24, 2015
• Unscored
  USN-2811-1 1 CVE

  strongswan vulnerability

  It was discovered that the strongSwan eap-mschapv2 plugin incorrectly handled state. A remote attacker could use this issue to bypass authentication.

  Feb 10, 2026

  first Nov 16, 2015
• Unscored
  USN-2808-1 3 CVEs

  wpa vulnerabilities

  It was discovered that wpa_supplicant incorrectly handled WMM Sleep Mode Response frame processing. A remote attacker could use this issue to perform broadcast/multicast packet injections, or cause a denial of service. (CVE-2015-5310) It was discovered that w…

  Feb 10, 2026

  first Nov 10, 2015
• Unscored
  USN-2807-1 1 CVE

  linux-lts-wily vulnerability

  Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the host OS.

  Feb 10, 2026

  first Nov 10, 2015
• Unscored
  USN-2806-1 1 CVE

  linux-lts-vivid vulnerability

  Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the host OS.

  Feb 10, 2026

  first Nov 10, 2015
• Unscored
  USN-2805-1 1 CVE

  linux-lts-utopic vulnerability

  Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the host OS.

  Feb 10, 2026

  first Nov 10, 2015
• Unscored
  USN-2798-1 2 CVEs

  linux-lts-vivid vulnerabilities

  It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. (CVE-2015-2925) Moein Ghasemzadeh discovered t…

  Feb 10, 2026

  first Nov 5, 2015
• Unscored
  USN-2797-1 4 CVEs

  linux-lts-utopic vulnerabilities

  It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to th…

  Feb 10, 2026

  first Nov 5, 2015