Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,435 results · Feed

  • High max 7.8
    USN-4360-1 1 CVE

    json-c vulnerability

    It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to execute arbitrary code.

    first May 14, 2020
  • Unscored
    USN-4314-1 1 CVE

    libpam-krb5 vulnerability

    Russ Allbery discovered that pam-krb5 incorrectly handled some responses. An attacker could possibly use this issue to execute arbitrary code.

    first Mar 31, 2020
  • Medium max 6.1
    USN-4277-1 3 CVEs

    libexif vulnerabilities

    Liu Bingchang discovered that libexif incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information or cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. …

    first Feb 11, 2020
  • High max 7.5
    USN-4274-1 2 CVEs

    libxml2 vulnerabilities

    It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-19956, CVE-2020-7595)

    first Feb 10, 2020
  • Unscored
    USN-4256-1 1 CVE

    cyrus-sasl2 vulnerability

    It was discovered that Cyrus SASL incorrectly handled certain LDAP packets. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service.

    first Jan 28, 2020
  • High max 7.5
    USN-4249-1 1 CVE

    e2fsprogs vulnerability

    It was discovered that e2fsprogs incorrectly handled certain ext4 partitions. An attacker could possibly use this issue to execute arbitrary code.

    first Jan 23, 2020
  • Unscored
    USN-4231-1 1 CVE

    nss vulnerability

    It was discovered that NSS incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.

    first Jan 8, 2020
  • Unscored
    USN-4358-1 2 CVEs

    libexif vulnerabilities

    It was discovered that libexif incorrectly handled certain tags. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-20030) It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this is…

    first May 13, 2020
  • Unscored
    USN-4336-3 6 CVEs

    binutils vulnerabilities

    USN-4336-1 fixed several vulnerabilities in GNU. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were…

    first Aug 9, 2023
  • Critical max 9.8
    USN-4272-1 5 CVEs

    pillow vulnerabilities

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911) It was discovered that Pillow incorrectly handled certain images. An attacker could poss…

    first Feb 6, 2020
  • Unscored
    USN-4243-1 2 CVEs

    libbsd vulnerabilities

    It was discovered that libbsd incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2016-2090) It was discovered that libbsd incorrectly handled certain strings…

    first Jan 20, 2020
  • Unscored
    USN-4827-1 1 CVE

    libcrypto++ vulnerability

    It was discovered that Crypto++ mishandled certain input. An attacker could use this vulnerability to leak potentially sensitive information.

    first Mar 15, 2021
  • Unscored
    USN-4229-1 1 CVE

    ntp vulnerability

    It was discovered that ntpq and ntpdc incorrectly handled some arguments. An attacker could possibly use this issue to cause ntpq or ntpdc to crash, execute arbitrary code, or escalate to higher privileges.

    first Jan 9, 2020
  • Medium max 5.3
    USN-4221-1 1 CVE

    libpcap vulnerability

    It was discovered that libpcap did not properly validate PHB headers in some situations. An attacker could use this to cause a denial of service (memory exhaustion).

    first Dec 11, 2019
  • Unscored
    USN-4215-1 1 CVE

    nss vulnerability

    It was discovered that NSS incorrectly handled certain certificates. An attacker could possibly use this issue to cause a denial of service.

    first Dec 9, 2019
  • Medium max 6.7
    USN-4176-1 1 CVE

    cpio vulnerability

    Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to privilege escalation.

    first Nov 6, 2019
  • Unscored
    USN-4169-1 1 CVE

    libarchive vulnerability

    It was discovered that libarchive incorrectly handled certain archive files. An attacker could possibly execute arbitrary code.

    first Oct 29, 2019
  • High max 7.5
    USN-4164-1 3 CVEs

    libxslt vulnerabilities

    It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this issue to access sensitive information. This issue not affected Ubuntu 19.10. (CVE-2019-13117, CVE-2019-13118) It was discovered that Libxslt incorrectly …

    first Oct 22, 2019
  • Medium max 5.9
    USN-3977-2 4 CVEs

    intel-microcode update

    USN-3977-1 provided mitigations for Microarchitectural Data Sampling (MDS) vulnerabilities in Intel Microcode for a large number of Intel processor families. This update provides the corresponding updated microcode mitigations for Intel Cherry Trail and Bay T…

    first May 22, 2019
  • Unscored
    USN-4155-1 1 CVE

    aspell vulnerability

    It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information.

    first Oct 15, 2019
  • Unscored
    USN-4154-1 1 CVE

    sudo vulnerability

    Joe Vennix discovered that Sudo incorrectly handled certain user IDs. An attacker could potentially exploit this to execute arbitrary commands as the root user.

    first Oct 14, 2019
  • Unscored
    USN-3421-2 1 CVE

    libidn2-0 vulnerability

    USN-3421-1 fixed a vulnerability in Libidn2. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

    first Mar 15, 2021
  • Critical max 9.8
    USN-6990-1 1 CVE

    znc vulnerability

    Johannes Kuhn (DasBrain) discovered that znc incorrectly handled user input under certain operations. An attacker could possibly use this issue to execute arbitrary code on a user's system if the user was tricked into joining a malicious server.

    first Sep 4, 2024
  • High max 8.8
    USN-6981-2 3 CVEs 2 exploited

    drupal7 vulnerabilities

    USN-6981-1 fixed vulnerabilities in Drupal. This update provides the corresponding updates for Ubuntu 14.04 LTS. Original advisory details: It was discovered that Drupal incorrectly sanitized uploaded filenames. A remote attacker could possibly use this issue…

    first Sep 3, 2024
  • High max 7.5
    USN-6644-1 3 CVEs

    tiff vulnerabilities

    It was discovered that LibTIFF incorrectly handled certain files. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause the application to crash, resulting in a denial of service. (CVE-2023-52356) It …

    first Feb 19, 2024
  • High max 7.8
    USN-6601-1 1 CVE

    linux vulnerability

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

    first Jan 25, 2024
  • Unscored
    USN-6579-1 1 CVE

    xerces-c vulnerability

    It was discovered that Xerces-C++ was not properly handling memory management operations when parsing XML data containing external DTDs, which could trigger a use-after-free error. If a user or automated system were tricked into processing a specially crafted…

    first Jan 11, 2024
  • Critical max 9.1
    USN-6559-1 2 CVEs

    zookeeper vulnerabilities

    It was discovered that ZooKeeper incorrectly handled authorization for the getACL() command. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-0201) Damie…

    first Jan 16, 2024
  • Medium max 6.2
    USN-6543-1 1 CVE

    tar vulnerability

    It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could use this issue to cause tar to crash, resulting in a denial of service.

    first Dec 11, 2023
  • Medium max 5.5
    USN-6413-1 10 CVEs

    binutils vulnerabilities

    It was discovered that GNU binutils was not properly performing checks when dealing with memory allocation operations, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. This issue only af…

    first Oct 4, 2023
  • Critical max 9.1
    USN-8476-1 4 CVEs

    xrdp vulnerabilities

    It was discovered that xrdp incorrectly handled bounds checking when processing user domain information during the connection sequence. An unauthenticated remote attacker could use this issue to cause xrdp to crash, resulting in a denial of service, or possib…

  • Critical max 9.9
    USN-8470-1 1 CVE

    cpp-httplib vulnerability

    It was discovered that cpp-httplib incorrectly percent-decoded HTTP request header values. A remote attacker could use this to inject crafted header content possibly leading to response splitting, log injection or proxy smuggling.

  • Unscored
    USN-8276-1 0 CVEs

    Highlight.js vulnerability

    It was discovered that Highlight.js used plain JavaScript objects for internal language name lookups, making them susceptible to prototype pollution attacks. An attacker could use this to cause a denial of service or unexpected application behaviour.

    first May 19, 2026
  • Unscored
    USN-8272-1 0 CVEs

    smarty3 vulnerability

    Takuya Aramaki discovered that Smarty did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-site scripting attack.

    first May 19, 2026
  • Unscored
    USN-8262-1 0 CVEs

    lua5.1 vulnerability

    It was discovered that the Lua parser incorrectly handled garbage collection when processing specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

    first May 8, 2026
  • Unscored
    USN-8247-1 0 CVEs

    owslib vulnerability

    It was discovered that OWSLib did not properly disable entity resolution within its XML parser. An attacker could possibly use this issue to read arbitrary files via a crafted XML payload.

    first May 7, 2026
  • Unscored
    USN-8242-1 0 CVEs

    civicrm vulnerability

    Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-site scripting attack.

    first May 7, 2026
  • Unscored
    USN-8241-1 0 CVEs

    coin3 vulnerabilities

    It was discovered that Expat, vendored in Coin3D incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

    first May 7, 2026
  • Unscored
    USN-8240-1 0 CVEs

    swish-e vulnerabilities

    It was discovered that Expat, vendored in Swish-e incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-25235, CVE-2022-25236)

    first May 7, 2026
  • Unscored
    USN-8235-1 0 CVEs

    insighttoolkit vulnerabilities

    It was discovered that Expat, vendored in ITK incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-25235, CVE-2022-25236)

    first May 7, 2026