Vendor
Canonical
224 known vulnerabilities.
Products
224 results · Feed
-
High 8.8
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a l…
-
High 8.8
Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.
-
Medium 4.8
snapd will follow archived symlinks when unpacking a filesystem
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the s…
-
Medium 5.8
snapd non-regular file indefinite blocking read
In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries with…
-
Medium 6.3
snapd allows $HOME/bin symlink
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a…
-
High 8.8
An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate t…
-
Medium 4.4
The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju (>=3.0), Juju secrets…
-
Medium 5.9
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivi…
-
Critical 9.3
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegat…
-
Medium 6.5
netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.
-
Medium 5.5
Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing
-
High 7.8
Apport does not disable python crash handler before entering chroot
-
Medium 5.5
is_closing_session() allows users to consume RAM in the Apport process
-
High 7.1
is_closing_session() allows users to create arbitrary tcp dbus connections
-
Medium 5.5
is_closing_session() allows users to fill up apport.log
-
Medium 5.5
~/.config/apport/settings parsing is vulnerable to "billion laughs" attack
-
High 7.8
Apport can be tricked into connecting to arbitrary sockets as the root user
-
High 7.8CVE-2021-3899 Public exploit
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an a…
-
High 8.4
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
-
High 8.1
CVE-2024-5138: snapd snapctl auth bypass
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to tri…
-
Medium 6.5
Pebble service manager's file pull API allows access by any user
It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also ava…
-
Medium 6.7
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass …
-
Medium 6.7
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker …
-
Medium 5.5
Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.
-
High 7.8CVE-2022-3328 Public exploit
snapd Race Condition vulnerability
Race condition in snap-confine's must_mkdir_and_open_with_perms()
-
Medium 5.0CVE-2023-5536 Public exploit
A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the …
-
Medium 5.5
Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could us…
-
High 8.1
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservic…
-
Critical 10.0
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal wh…
-
High 7.8CVE-2023-32629 Public exploit
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks…
-
High 7.8
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overla…
-
Medium 6.1
Landscape Open Redirect
Landscape allowed URLs which caused open redirection.
-
Critical 9.3
Landscape's Apache server-status is accessible by default
Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
-
Medium 6.8
Landscape insecure token generation
Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.
-
Medium 4.4
shiftfs lock unbalance in Ubuntu-specific kernels
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
-
Medium 5.5
sensitive data exposure in cloud-init logs
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
-
High 7.7CVE-2023-1326 Public exploit
local privilege escalation in apport-cli
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be …
-
High 8.2
snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths
snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap c…