Ubuntu Security Notices (USN)

8,437 results · Feed

• Medium max 4.7
  USN-4941-1 4 CVEs

  exiv2 vulnerabilities

  It was discovered that Exiv2 incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2021-29457) It was discovered that Exiv2 incorrectly handled certain images. An attacker could possibly…

  Jun 25, 2026

  first May 10, 2021
• Medium max 5.3
  USN-6841-2 1 CVE

  php7.0, php7.2 vulnerability

  USN-6841-1 fixed a vulnerability in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that PHP could early return in the filter_var function resulting in invalid user in…

  Jun 25, 2026

  first Sep 9, 2024
• Medium max 4.5
  USN-6838-2 1 CVE

  ruby2.3, ruby2.5 vulnerability

  USN-6838-1 fixed CVE-2024-27281 in Ruby 2.7, Ruby 3.0, Ruby 3.1, and Ruby 3.2. This update provides the corresponding updates for Ruby 2.3 and Ruby 2.5. Original advisory details: It was discovered that Ruby RDoc incorrectly parsed certain YAML files. If a us…

  Jun 25, 2026

  first Feb 10, 2025
• Critical max 9.8
  USN-6834-1 2 CVEs

  h2database vulnerabilities

  It was discovered that H2 was vulnerable to deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-42392) It was discovered that H2 incorrectly handled some specially crafted connection URLs. An attac…

  Jun 25, 2026

  first Jun 13, 2024
• High max 7.5
  USN-6832-1 16 CVEs

  virtuoso-opensource vulnerabilities

  Jingzhou Fu discovered that Virtuoso Open-Source Edition incorrectly handled certain crafted SQL statements. An attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2023-31607, CVE-2023-31608, CVE-2023-31609, CVE…

  Jun 25, 2026

  first Jun 13, 2024
• High max 7.5
  USN-6826-1 1 CVE

  libapache-mod-jk vulnerability

  Karl von Randow discovered that mod_jk was vulnerable to an authentication bypass. If the configuration did not provide explicit mounts for all possible proxied requests, an attacker could possibly use this vulnerability to bypass security constraints configu…

  Jun 25, 2026

  first Jun 11, 2024
• Critical max 9.8
  USN-6825-1 3 CVEs

  libphp-adodb vulnerabilities

  It was discovered that the PDO driver in ADOdb was incorrectly handling string quotes. A remote attacker could possibly use this issue to perform SQL injection attacks. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7405) It was discovered that ADOdb wa…

  Jun 25, 2026

  first Jun 10, 2024
• Unscored
  USN-6824-1 3 CVEs

  giflib vulnerabilities

  It was discovered that GIFLIB incorrectly handled certain GIF files. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-40633, CVE-2022-28506, CVE-2023-39742)

  Jun 25, 2026

  first Jun 10, 2024
• High max 7.6
  USN-4867-1 2 CVEs

  runc vulnerabilities

  It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount over the /proc directory and escalate privileges. (CVE-2019-16884) Etienne Champetier discovered that runC incorrectly checked mou…

  Jun 25, 2026

  first Aug 10, 2021
• Unscored
  USN-4857-1 1 CVE

  bwa vulnerability

  It was discovered that Burrows-Wheeler Aligner (BWA) mishandled certain crafted .alt files. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code.

  Jun 25, 2026

  first Mar 15, 2021
• High max 7.8
  USN-4855-1 1 CVE

  ipython vulnerability

  It was discovered that IPython did not properly sanitize certain input. If a user were tricked into opening a specially crafted notebook file, a remote attacker could possibly use this issue to execute arbitrary code.

  Jun 25, 2026

  first Mar 15, 2021
• Critical max 10.0
  USN-4853-1 4 CVEs

  liblivemedia vulnerabilities

  It was discovered that liveMedia incorrectly handled certain network packets. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-4013) It was discovered that liveMedia incorrectly handled certain network sessions. An attacker could…

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4851-1 3 CVEs

  libsolv vulnerabilities

  It was discovered that Libsolv incorrectly handled certain malformed input. An attacker could use this issue to cause Libsolv to crash, resulting in a denial of service.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4846-1 2 CVEs

  yubico-piv-tool vulnerabilities

  It was discovered that libykpiv, a supporting library of the Yubico PIV tool and YubiKey PIV Manager, mishandled specially crafted input. An attacker with a custom-made, malicious USB device could potentially execute arbitrary code on a computer running the Y…

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4844-1 1 CVE

  cinnamon vulnerability

  Matthias Gerstner discovered that the cinnamon-settings-users utility in Cinnamon did not safely handle symlinks. An unprivileged attacker could potentially use this vulnerability to overwrite arbitrary files as root.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4842-1 1 CVE

  ntopng vulnerability

  It was discovered that ntopng did not properly seed its random number generator, leading to predictable session tokens. An attacker could use this vulnerability to hijack a user's session.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4828-1 1 CVE

  librelp vulnerability

  It was discovered that librelp did not properly manage x509 certificates, leading to a stack-based buffer overflow. A remote attacker could possibly use this issue to execute arbitrary code.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4824-1 1 CVE

  varnish vulnerability

  It was discovered that Varnish incorrectly handled certain inputs. A remote attacker could possibly use this issue to obtain sensitive information.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4823-1 1 CVE

  mosquitto vulnerability

  It was discovered that Mosquitto incorrectly handled certain inputs. A remote attacker could possibly use this issue to cause a denial of service.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4822-1 1 CVE

  firebird2.5 vulnerability

  It was discovered that Firebird exposed certain UDF libraries. An authenticated attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code.

  Jun 25, 2026

  first Mar 15, 2021
• High max 8.2
  USN-4821-1 1 CVE

  openpyxl vulnerability

  It was discovered that openpyxl incorrectly handled certain documents. A remote attacker could possibly use this issue to cause a denial of service or other unspecified impact.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4820-1 1 CVE

  s-nail vulnerability

  It was discovered that S-nail incorrectly handled paths. An attacker could possible use this issue to write arbitrary files and escalate privileges.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4814-1 2 CVEs

  asterisk vulnerabilities

  Richard Mudgett discovered that Asterisk did not properly check the length of input string when setting the user field for PartyB on a CDR. A remote attacker could use this vulnerability to cause a denial of service (crash) or potentially execute arbitrary co…

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-6472-1 1 CVE

  gsl vulnerability

  It was discovered that GNU Scientific Library incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service or execut…

  Jun 25, 2026

  first Nov 7, 2023
• Critical max 9.8
  USN-6470-1 1 CVE

  axis vulnerability

  It was discovered that Axis incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. …

  Jun 25, 2026

  first Nov 2, 2023
• Medium max 5.5
  USN-6437-1 5 CVEs

  vips vulnerabilities

  Ziqiang Gu discovered that VIPS could be made to dereference a NULL pointer. If a user or automated system were tricked into processing a specially crafted input image file, an attacker could possibly use this issue to cause a denial of service. This issue on…

  Jun 25, 2026

  first Oct 18, 2023
• Medium max 5.3
  USN-6435-1 2 CVEs

  openssl vulnerabilities

  It was discovered that OpenSSL incorrectly handled excessively large Diffie-Hellman parameters. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-3446) Bernd Edlinger discovered that OpenSSL incorrectly handled excessively larg…

  Jun 25, 2026

  first Oct 18, 2023
• Medium max 5.5
  USN-4804-1 2 CVEs

  puppet vulnerabilities

  It was discovered that Puppet installed modules with world writable permissions. An attacker could use this vulnerability to execute arbitrary code or cause a denial of service. (CVE-2017-10689) It was discovered that Puppet could be used to force YAML deseri…

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4800-1 3 CVEs

  lynx vulnerabilities

  It was discovered that Lynx incorrectly handled certain URLs. A remote attacker could possibly use this issue to obtain sensitive information or other unspecified impact. This issue only affected Ubuntu 16.04 ESM. (CVE-2016-9179) It was discovered that Lynx i…

  Jun 25, 2026

  first Mar 15, 2021
• Critical max 9.8
  USN-4795-1 1 CVE

  groovy2 vulnerability

  It was discovered that Apache Groovy incorrectly handled serialization mechanisms. An attacker could possibly use this issue to execute arbitrary code.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4794-1 2 CVEs

  libupnp vulnerabilities

  Matthew Garrett discovered that libupnp mishandled POST requests by default. An attacker could use this vulnerability to write files to arbitrary locations in the victim's filesystem, possibly as root. (CVE-2016-6255) It was discovered that libupnp mishandled…

  Jun 25, 2026

  first Mar 15, 2021
• High max 7.5
  USN-4786-1 2 CVEs

  node-moment vulnerabilities

  It was discovered that Moment.js mishandled certain regular expressions. An attacker could use this vulnerability to cause a denial of service.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4785-1 1 CVE

  npm vulnerability

  It was discovered that the npm command-line interface mishandled certain sensitive information. An attacker could use this vulnerability to collect authentication information that could be used to impersonate other users.

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4784-1 3 CVEs

  xerces-c vulnerabilities

  It was discovered that Xerces-C++ XML Parser mishandles certain kinds of external DTD references, resulting in a user-after-free. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. This issue affe…

  Jun 25, 2026

  first Mar 15, 2021
• Unscored
  USN-4782-1 6 CVEs

  openjpeg2 vulnerabilities

  It was discovered that OpenJPEG incorrectly handled certain image files. A remote attacker could possibly use this issue to cause a denial of service. CVE-2016-10506 and CVE-2017-12982 affected only Ubuntu 16.04 ESM. CVE-2018-16375, CVE-2018-20845 and CVE-201…

  Jun 25, 2026

  first Mar 17, 2021
• High max 7.5
  USN-6448-1 1 CVE

  sofia-sip vulnerability

  Xu Biang discovered that Sofia-SIP did not properly manage memory when handling STUN packets. An attacker could use this issue to cause Sofia-SIP to crash, resulting in a denial of service, or possibly execute arbitrary code.

  Jun 25, 2026

  first Oct 24, 2023
• Critical max 9.1
  USN-6432-1 2 CVEs

  quagga vulnerabilities

  It was discovered that the Quagga BGP daemon did not properly check the attribute length in NRLI. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41358) It was discovered that the Quagga BGP daemon did not properly mana…

  Jun 25, 2026

  first Oct 17, 2023
• Unscored
  USN-6431-1 1 CVE

  iperf3 vulnerabilities

  It was discovered that iperf3 did not properly manage certain inputs, which could lead to a crash. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-38403) Jorge Sancho Larraz discovered that iperf3 did not properly manag…

  Jun 25, 2026

  first Oct 16, 2023
• Unscored
  USN-6430-1 6 CVEs

  ffmpeg vulnerabilities

  It was discovered that FFmpeg did not properly handle certain inputs in vf_lagfun.c, resulting in a buffer overflow vulnerability. An attacker could possibly use this issue to cause a denial of service via application crash. This issue only affected Ubuntu 20…

  Jun 25, 2026

  first Oct 12, 2023
• Medium max 4.9
  USN-4586-2 1 CVE

  php-imagick vulnerability

  USN-4586-1 fixed vulnerabilities in PHP ImageMagick. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: It was discovered that PHP ImageMagick extension didn't check the address used by an array. An attacker could u…

  Jun 25, 2026

  first Jan 24, 2022