8,435 results · Feed
-
High max 7.9USN-4076-1 6 CVEs
linux, linux-aws, linux-kvm, linux-raspi2 vulnerabilities
It was discovered that a race condition existed in the Serial Attached SCSI (SAS) implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2018-20836) It was disco…
first Jul 25, 2019 -
UnscoredUSN-4068-2 4 CVEs
linux-hwe, linux-gcp vulnerabilities
USN-4068-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 for Ubuntu 16.04 LTS. Adam Zabrocki discovered that the Intel i915 kerne…
first Jul 23, 2019 -
Medium max 6.5USN-3932-2 20 CVEs
linux-lts-xenial, linux-aws vulnerabilities
USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a race condition existe…
first Apr 2, 2019 -
UnscoredUSN-3930-2 13 CVEs
linux-hwe, linux-azure vulnerabilities
USN-3930-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS. Mathias Payer and Hui Peng discovered a use-after-free…
first Apr 2, 2019 -
UnscoredUSN-2891-1 17 CVEs
qemu, qemu-kvm vulnerabilities
Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X support. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-7549) Li…
first Feb 3, 2016 -
UnscoredUSN-2854-1 4 CVEs
linux-lts-vivid vulnerabilities
Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute ar…
first Dec 20, 2015 -
UnscoredUSN-2853-1 4 CVEs
linux-lts-wily vulnerabilities
Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute ar…
first Dec 20, 2015 -
UnscoredUSN-2849-1 4 CVEs
linux-lts-utopic vulnerabilities
Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute ar…
first Dec 19, 2015 -
UnscoredUSN-2848-1 4 CVEs
linux vulnerabilities
Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute ar…
first Dec 19, 2015 -
Critical max 10.0USN-2844-1 3 CVEs
linux-lts-utopic vulnerabilities
Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the host OS. …
first Dec 17, 2015 -
Critical max 10.0USN-2841-1 3 CVEs
linux vulnerabilities
Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the host OS. …
first Dec 17, 2015 -
Medium max 6.1USN-4284-1 23 CVEs
linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-raspi2-5.3 vulnerabilities
It was discovered that the Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors. A local attacker could use this to expose sensitive information. (CVE-2019-14615) It was discovered that the Atheros 802.…
first Feb 19, 2020 -
Critical max 9.8USN-8261-1 609 CVEs
linux-xilinx vulnerabilities
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issu…
first May 7, 2026 -
Critical max 9.8USN-8714-2 5 CVEs
linux-aws-5.4, linux-gcp, linux-gcp-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - OCFS2 file system; - SCTP protocol; (CVE-2026-53043, CVE-2026-53224, CVE-2026…
first Sep 4, 2026 -
Low max 2.9USN-8720-1 1 CVE
gnupg2 vulnerability
It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks.
-
Critical max 9.1USN-8719-1 4 CVEs
apr-util vulnerabilities
It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-49506) It was discovered that APR-util incorrectly handle…
-
Medium max 5.5USN-8718-1 1 CVE
sssd vulnerability
It was discovered that SSSD did not properly validate authentication token lengths when processing PAM responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a denial of service.
-
Critical max 9.8USN-8716-1 14 CVEs
Several security issues were fixed in FFmpeg.
It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-64830) It was discovered that FFmpeg inco…
-
Medium max 5.1USN-8723-1 2 CVEs
spice-vdagent vulnerabilities
It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of s…
-
High max 8.8USN-8722-1 3 CVEs
libssh2 vulnerabilities
It was discovered that libssh2 incorrectly handled certain SFTP server responses. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code. (CVE-2026-66032) It was discovered that libssh2 in…
-
Medium max 4.8USN-8721-1 3 CVEs
openssh vulnerabilities
It was discovered that OpenSSH's ssh-agent incorrectly handled interactions between agent locking and the session-bind@openssh.com extension. A remote attacker with access to a forwarded agent connection could possibly use this issue to perform operations tha…
-
Medium max 5.9USN-8717-1 1 CVE
tika vulnerability
It was discovered that Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who could place files in a directory that Tika subsequently parses could use this issue to read arbitrary files accessible to the Tika process and have t…
-
Critical max 9.8USN-8678-1 10 CVEs
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. …
first Aug 25, 2026 -
Critical max 9.1USN-8678-3 1 CVE
openssl vulnerability
USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorre…
first Aug 31, 2026 -
Medium max 6.5USN-8690-1 1 CVE
pillow vulnerability
It was discovered that Pillow did not properly manage memory when processing certain image files. An attacker could possibly use this issue to cause a denial of service or read sensitive data.
first Sep 1, 2026 -
Critical max 9.8USN-8714-1 5 CVEs
linux, linux-aws, linux-azure, linux-azure-fips, linux-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - OCFS2 file system; - SCTP protocol; (CVE-2026-53043, CVE-2026-53224, CVE-2026…
first Sep 2, 2026 -
Critical max 9.8USN-8713-1 2 CVEs
biosig vulnerabilities
Mark Bereza and Lilith Wyatt discovered that BioSig incorrectly handled certain crafted input files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-22891, CVE-2026-20777)
first Sep 2, 2026 -
Medium max 6.4USN-8672-1 1 CVE
sssd vulnerability
It was discovered that the SSSD PAM responder may crash if a physically proximate attacker manipulates a smartcard or Yubikey. Non-malicious physically proximate users may not be able to log in depending upon the details of their legitimate smartcard or Yubik…
first Aug 25, 2026 -
High max 7.5USN-8712-1 3 CVEs
pyasn1 vulnerabilities
It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resou…
first Sep 1, 2026 -
Medium max 5.9USN-8711-1 1 CVE
libgcrypt20 vulnerability
It was discovered that Libgcrypt had a timing-based side-channel flaw in its RSA implementation. A remote attacker could possibly use this issue to obtain sensitive information.
first Sep 1, 2026 -
Low max 3.3USN-8709-1 1 CVE
ncurses vulnerability
It was discovered that ncurses incorrectly handled specially crafted terminfo database entries. A local attacker could possibly use this issue to cause applications using ncurses to crash, resulting in a denial of service.
first Sep 1, 2026 -
Critical max 9.2USN-8710-1 5 CVEs
libevent vulnerabilities
Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18…
first Sep 1, 2026 -
Medium max 6.8USN-8707-1 3 CVEs
opencryptoki vulnerabilities
It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. (CVE-2026-40253) It was discovered that openCryptoki incorrectly …
first Aug 31, 2026 -
UnscoredUSN-8688-2 0 CVEs
pam vulnerability
USN-8688-1 fixed a vulnerability in PAM. This update provides the corresponding fix for PAM on Ubuntu 26.04 LTS. Original advisory details: Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records when certain services invo…
first Sep 1, 2026 -
UnscoredUSN-8708-1 0 CVEs
rust-sudo-rs vulnerability
It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate…
-
UnscoredUSN-8555-2 0 CVEs
ubuntu-advantage-tools regression
USN-8555-1 fixed vulnerabilities in Ubuntu Advantage Tools. On Ubuntu 14.04 LTS only, it was discovered that some machines were unable to enable esm-infra-legacy due to a preemptive apt-helper check. This update fixes the problem. We apologize for the inconve…
-
Medium max 4.6USN-8704-1 3 CVEs
cpio vulnerabilities
It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create h…
first Aug 31, 2026 -
High max 7.3USN-8705-2 1 CVE
zfs-linux vulnerability
USN-8705-1 fixed vulnerabilities in OpenZFS. This update provides the corresponding fix for OpenZFS on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl …
first Aug 31, 2026 -
Medium max 4.8USN-8685-1 1 CVE
bzip2 vulnerability
It was discovered that bzip2 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a crash, resulting in a denial of service.
first Aug 27, 2026 -
High max 7.8USN-8701-1 1 CVE
udisks2 vulnerability
It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. A local attacker with an active console session could possibly use this issue to moun…