Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

8,437 results · Feed

  • Unscored
    USN-5334-1 1 CVE

    man-db vulnerability

    It was discovered that man-db incorrectly handled permission changing operations in its daily cron job, and was therefore affected by a race condition. An attacker could possibly use this issue to escalate privileges and execute arbitrary code.

    first Mar 17, 2022
  • Unscored
    USN-5331-1 2 CVEs

    tcpdump vulnerabilities

    It was discovered that tcpdump incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2018-16301) It was discovered that tcpdump incorrectly handled certain captured…

    first Mar 16, 2022
  • Medium max 5.3
    USN-5326-1 1 CVE

    fuse vulnerability

    It was discovered that FUSE is susceptible to a restriction bypass flaw on a system that has SELinux active. A local attacker with non-root privileges could mount a FUSE file system that is accessible to other users and trick them into accessing files on that…

    first Mar 16, 2022
  • Unscored
    USN-5325-1 2 CVEs

    zsh vulnerabilities

    Sam Foxman discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to regain dropped privileges. (CVE-2019-20044) It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issu…

    first Mar 14, 2022
  • Unscored
    USN-5322-1 1 CVE

    subversion vulnerability

    Thomas Akesson discovered that Subversion incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.

    first Mar 10, 2022
  • High max 7.1
    USN-5315-1 4 CVEs

    ansible vulnerabilities

    It was discovered that Ansible did not properly manage directory permissions when running playbooks with an unprivileged become user. A local attacker could possibly use this issue to cause a race condition, escalate privileges and execute arbitrary code. Thi…

    first Jun 7, 2022
  • Critical max 9.8
    USN-5310-2 3 CVEs

    glibc vulnerabilities

    USN-5310-1 fixed several vulnerabilities in GNU. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this is…

    first Mar 7, 2022
  • High max 7.5
    USN-5308-1 11 CVEs

    libssh2 vulnerabilities

    It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the client system. (CVE-2019-3855) It was discovered…

    first Mar 7, 2022
  • Medium max 5.3
    USN-5300-1 6 CVEs

    php7.0 vulnerabilities

    It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. (CVE-2015-9253, CVE-2017-8923, CVE-2017-9118, CVE-2017-9120) It was discovered that PHP incorrectly handled certain inputs.…

    first Feb 22, 2022
  • High max 7.5
    USN-5293-2 1 CVE

    c3p0 vulnerability

    USN-5293-1 fixed a vulnerability in c3p0. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the applic…

    first Feb 22, 2022
  • Unscored
    USN-5282-1 5 CVEs

    pdfresurrect vulnerabilities

    It was discovered that PDFResurrect was incorrectly handling corrupted PDF files. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service, or arbitrary code execution. This issue only affected Ubuntu 16.04 ESM an…

    first Jun 3, 2022
  • Unscored
    USN-5281-1 5 CVEs

    opensc vulnerabilities

    It was discovered that some OpenSC smart card drivers mishandled memory when performing certain decoding operations. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 ESM …

    first Jun 8, 2022
  • Unscored
    USN-5280-1 1 CVE

    speex vulnerability

    It was discovered that Speex incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service.

    first Feb 10, 2022
  • Unscored
    USN-5273-1 3 CVEs

    rpm vulnerabilities

    Demi M. Obenour discovered that RPM Package Manager incorrectly handled certain files. An attacker could possibly use this issue to corrupt the database and cause a denial of service. (CVE-2021-3421, CVE-2021-20271) Demi M. Obenour discovered that RPM Package…

    first Jul 21, 2022
  • High max 8.8
    USN-5275-1 1 CVE

    bluez vulnerability

    Ziming Zhang discovered that BlueZ incorrectly handled memory write operations in its gatt server. A remote attacker could possibly use this to cause BlueZ to crash leading to a denial of service, or potentially remotely execute code. (CVE-2022-0204)

    first Feb 8, 2022
  • Unscored
    USN-5264-1 3 CVEs

    graphviz vulnerabilities

    It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. (CVE-2018-10196, CVE-2019-11023) It was discovered that graphviz contains a buffer overflow vulne…

    first Feb 3, 2022
  • Unscored
    USN-5259-1 4 CVEs

    cron vulnerabilities

    It was discovered that the postinst maintainer script in Cron unsafely handled file permissions during package install or update operations. An attacker could possibly use this issue to perform a privilege escalation attack. (CVE-2017-9525) Florian Weimer dis…

    first Feb 1, 2022
  • Medium max 4.6
    USN-5258-1 5 CVEs

    weechat vulnerabilities

    Stuart Nevans Locke discovered that WeeChat's relay plugin insecurely handled malformed websocket frames. A remote attacker in control of a server could possibly use this issue to cause denial of service in a client. (CVE-2021-40516) Stuart Nevans Locke disco…

    first Feb 4, 2022
  • Unscored
    USN-5257-1 2 CVEs

    ldns vulnerabilities

    It was discovered that ldns incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2020-19860, CVE-2020-19861)

    first Jan 31, 2022
  • High max 7.5
    USN-5271-1 3 CVEs 1 exploited

    adminer vulnerabilities

    It was discovered that Adminer did not escape data in the history parameter of the default URI. A remote attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-35572) Adam Cro…

    first Jun 3, 2022
  • Medium max 5.5
    USN-5270-2 6 CVEs

    mysql-5.7 vulnerabilities

    USN-5270-1 fixed several vulnerabilities in MySQL. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix the…

    first Feb 3, 2022
  • Critical max 9.1
    USN-5245-1 1 CVE

    maven vulnerability

    It was discovered that Apache Maven followed repositories that are defined in a dependency's Project Object Model (pom) even if the repositories weren't encrypted (http protocol). An attacker could use this vulnerability to take over a repository, execute arb…

    first Aug 18, 2022
  • Unscored
    USN-5244-1 1 CVE

    dbus vulnerability

    Daniel Onaca discovered that DBus contained a use-after-free vulnerability, caused by the incorrect handling of usernames sharing the same UID. An attacker could possibly use this issue to cause DBus to crash, resulting in a denial of service.

    first Jan 20, 2022
  • Unscored
    USN-5236-1 1 CVE

    A security issue was fixed in pngcrush

    Brian Carpenter discovered that pngcrush incorrectly handled specially crafted file. An attacker could possibly use this issue to cause a denial of service.

    first Jan 19, 2022
  • Critical max 9.8
    USN-5235-1 3 CVEs

    ruby2.3, ruby2.5, ruby2.7 vulnerabilities

    It was discovered that Ruby incorrectly handled certain HTML files. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. (CVE-2021-41816) It was discovered that Ruby incorrectly…

    first Jan 18, 2022
  • Medium max 4.3
    USN-5234-1 1 CVE

    byobu vulnerability

    Sander Bos discovered that Byobu incorrectly handled certain Apport data. An attacker could possibly use this issue to expose sensitive information.

    first Jan 18, 2022
  • Unscored
    USN-5231-1 2 CVEs

    389-ds-base vulnerabilities

    It was discovered that 389 Directory Server presented to users, during authentication, an error message which could be used to discover if a certain LDAP DN existed or not. A remote unauthenticated attacker could possibly use this to check the existence of an…

    first Jul 18, 2022
  • Unscored
    USN-5230-1 1 CVE

    cpanminus vulnerability

    It was discovered that App::cpanminus did not properly verify CHECKSUMS files. An attacker could possibly use this issue to bypass signature verification, gaining access to sensitive data or possibly executing unauthorized code.

    first Jan 24, 2022
  • High max 7.5
    USN-5223-2 1 CVE

    apache-log4j1.2 vulnerability

    USN-5223-1 fixed a vulnerability in Apache Log4j 1.2. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: It was discovered that Apache Log4j 1.2 was vulnerable to deserialization of untrusted data if the configurati…

    first Feb 8, 2022
  • High max 8.8
    USN-5220-1 1 CVE

    composer vulnerability

    It was discovered that Composer did not properly sanitize URLs for Mercurial repositories in the root composer.json and package source download URLs. A remote attacker could possibly use this issue to execute arbitrary code.

    first Jul 8, 2022
  • High max 7.5
    USN-5215-1 1 CVE

    nltk vulnerability

    Srikantha Prathi discovered that NLTK incorrectly handled specially crafted input. An attacker could use this vulnerability to cause a denial of service.

    first Jan 10, 2022
  • Unscored
    USN-5214-1 5 CVEs

    cacti vulnerabilities

    It was discovered that Cacti was incorrectly validating permissions for user accounts that had been recently disabled. An authenticated attacker could possibly use this to obtain unauthorized access to application and system data. (CVE-2020-13230) It was disc…

    first Jun 9, 2022
  • Unscored
    USN-5205-1 13 CVEs

    tcpreplay vulnerabilities

    It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-13112) …

    first Oct 4, 2022
  • High max 7.5
    USN-5202-1 14 CVEs

    openjdk-8, openjdk-lts vulnerabilities

    Varnavas Papaioannou discovered that the FTP client implementation in OpenJDK accepted alternate server IP addresses when connecting with FTP passive mode. An attacker controlling an FTP server that an application connects to could possibly use this to expose…

    first Dec 17, 2021
  • Unscored
    USN-5195-2 1 CVE

    mumble vulnerability

    It was discovered that the Mumble client supported websites for public servers with arbitrary URL schemes. If a user were tricked into visiting a malicious website from the public server list, a remote attacker could possibly execute arbitrary code.

    first Dec 15, 2021
  • Unscored
    USN-5193-3 3 CVEs

    xorg-server-hwe-16.04 vulnerabilities

    USN-5193-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain inputs. An attacker could use this…

    first Jul 27, 2023
  • Critical max 10.0
    USN-5192-2 1 CVE 1 exploited

    apache-log4j2 vulnerability

    USN-5192-1 fixed a vulnerability in Apache Log4j 2. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Chen Zhaojun discovered that Apache Log4j 2 allows remote attackers to run programs via a special crafted input.…

    first Dec 17, 2021
  • Medium max 6.3
    USN-5187-1 1 CVE

    glances vulnerability

    It was discovered that Glances incorrectly parsed untrusted XML data due to usage of xmlrpclib. An attacker could possibly use this to perform an External Entity (XXE) Injection and cause the host system to crash.

    first Jul 25, 2022
  • Critical max 9.8
    USN-5182-1 12 CVEs 4 exploited

    roundcube vulnerabilities

    It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML message. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 1…

    first Aug 8, 2022
  • High max 7.5
    USN-5179-2 1 CVE

    busybox vulnerability

    USN-5179-1 fixed vulnerabilities in BusyBox. This update provides the corresponding updates for Ubuntu 16.04 ESM. Original advisory details: It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were…

    first May 10, 2022