Canonical Ltd. vulnerabilities
49 vulnerabilities
Known vulnerabilities in Canonical Ltd. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
Products
21- Apport11 vulnerabilities
- Snapd7 vulnerabilities
- Juju5 vulnerabilities
- Cloud Init3 vulnerabilities
- Landscape3 vulnerabilities
- LXD3 vulnerabilities
- Authd2 vulnerabilities
- Subiquity2 vulnerabilities
- Ubuntu'S Gnome Control Center2 vulnerabilities
- Anbox Cloud1 vulnerabilities
- Linux Kernel, As Used In Ubuntu 18.04 LTS And Ubuntu 18.101 vulnerabilities
- Netplan1 vulnerabilities
- Pebble1 vulnerabilities
- Ubuntu Advantage Desktop Pro1 vulnerabilities
- Ubuntu Desktop Provision1 vulnerabilities
- Ubuntu EDK II1 vulnerabilities
- Ubuntu Pipewire Pulse1 vulnerabilities
- Ubuntu Linux1 vulnerabilities
- Ubuntu'S Pulseaudio1 vulnerabilities
- Wpa Supplicant1 vulnerabilities
- Accountservice0 vulnerabilities
CVE-2018-6559chainguardhyperv-daemons-6.18+88
EPSS score0.53%
The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace.CVE-2021-4120canonical ltd.snapd+5EPSS score0.44%
snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1CVE-2021-44730canonical ltd.snapd+6EPSS score0.35%
snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1CVE-2021-44731canonical ltd.snapd+6EPSS score0.95%
A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1CVE-2021-3429canonical ltd.cloud-init+5EPSS score0.22%
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.CVE-2021-3899canonical ltd.apport+3EPSS score0.38%
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.CVE-2021-3155canonical ltd.snapd+4EPSS score0.26%
snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1CVE-2020-11936canonical ltd.apport+2EPSS score0.34%
gdbus setgid privilege escalationCVE-2020-27352canonical ltd.snapd+4EPSS score0.26%
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.CVE-2022-2084canonical ltd.cloud-init+5EPSS score0.24%
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.CVE-2022-1736canonical ltd.ubuntu's gnome-control-center+4EPSS score0.74%
Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.CVE-2022-1242canonical ltd.apport+3EPSS score0.23%
Apport can be tricked into connecting to arbitrary sockets as the root userCVE-2022-0555canonical ltd.subiquity+2EPSS score0.28%
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all PermissionsCVE-2022-4968canonical ltd.netplan+3EPSS score0.26%
netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.CVE-2022-4964canonical ltd.ubuntu pipewire-pulse+4EPSS score0.28%
Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.CVE-2022-28654apport_projectapport+3EPSS score0.25%
is_closing_session() allows users to fill up apport.logCVE-2022-28657apport_projectapport+3EPSS score0.23%
Apport does not disable python crash handler before entering chrootCVE-2022-28653canonical ltd.apport+2EPSS score0.40%
Users can consume unlimited disk space in /var/crashCVE-2022-28652apport_projectapport+3EPSS score0.20%
~/.config/apport/settings parsing is vulnerable to "billion laughs" attackCVE-2022-28656apport_projectapport+3EPSS score0.20%
is_closing_session() allows users to consume RAM in the Apport process