Canonical Ltd. vulnerabilities, page 2
49 vulnerabilities
Known vulnerabilities in Canonical Ltd. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
CVE-2022-28655apport_projectapport+3
EPSS score0.21%
is_closing_session() allows users to create arbitrary tcp dbus connectionsCVE-2022-28658apport_projectapport+3EPSS score0.20%
Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofingCVE-2022-3328canonical ltd.snapd+5EPSS score0.38%
Race condition in snap-confine's must_mkdir_and_open_with_perms()CVE-2024-11586chainguardlibpulse+24EPSS score0.30%
Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.CVE-2024-9313canonical ltd.authd+2EPSS score0.58%
Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.CVE-2024-9312canonical ltd.authd+2EPSS score0.28%
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.CVE-2024-7558canonical ltd.juju+2EPSS score0.50%
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.CVE-2024-5138canonical ltd.snapd+4EPSS score0.83%
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.CVE-2024-5290chainguardwpa_supplicant+4EPSS score0.65%
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.CVE-2024-6156canonical ltd.lxd+5EPSS score0.16%
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.CVE-2024-6984canonical ltd.juju+2EPSS score0.38%
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.CVE-2024-6714canonical ltd.ubuntu desktop provision+2EPSS score0.26%
An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.CVE-2024-6388canonical ltd.ubuntu advantage desktop pro+2EPSS score0.15%
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.CVE-2024-6219canonical ltd.lxd+3EPSS score0.16%
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.CVE-2024-8037canonical ltd.juju+2EPSS score0.19%
Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.CVE-2024-8287canonical ltd.anbox cloud+1EPSS score0.18%
Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this.CVE-2024-8038canonical ltd.juju+2EPSS score0.21%
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.CVE-2024-3250canonical ltd.pebble+2EPSS score0.20%
It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2, and v1.7.4.CVE-2023-2612canonical ltd.ubuntu-linux+87EPSS score0.28%
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).CVE-2023-1786canonical ltd.cloud-init+13EPSS score0.26%
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.