Ubuntu vulnerabilities
126 vulnerabilities
Known vulnerabilities in Ubuntu products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 40 products.
Products
40- Ubuntu Linux64 vulnerabilities
- Ubuntu6 vulnerabilities
- Linux5 vulnerabilities
- Linux Kernel5 vulnerabilities
- MAAS5 vulnerabilities
- Grub2 In Ubuntu3 vulnerabilities
- Python Apt3 vulnerabilities
- Shiftfs In The Linux Kernel3 vulnerabilities
- Apport2 vulnerabilities
- Language Selector2 vulnerabilities
- Metal As A Service2 vulnerabilities
- Unity82 vulnerabilities
- 18.04 LTS (Bionic) Linux Kernel1 vulnerabilities
- 73 Oubuntu1 vulnerabilities
- Accountsservice1 vulnerabilities
- Apparmor1 vulnerabilities
- Base Files1 vulnerabilities
- Cobbler1 vulnerabilities
- Content Hub1 vulnerabilities
- Edk21 vulnerabilities
- Edubuntu1 vulnerabilities
- Juju1 vulnerabilities
- Libefiboot1 vulnerabilities
- Libvirt1 vulnerabilities
- LXD1 vulnerabilities
- Network Manager1 vulnerabilities
- Openssh1 vulnerabilities
- Oxide1 vulnerabilities
- Python Dbusmock1 vulnerabilities
- Signon1 vulnerabilities
- Snapweb1 vulnerabilities
- Tmux1 vulnerabilities
- Ubuntu Download Manager1 vulnerabilities
- Ubuntu Package Linux Bluefield1 vulnerabilities
- Unity Scope Gdrive1 vulnerabilities
- Upstart1 vulnerabilities
- Vivid1 vulnerabilities
- Whoopsie1 vulnerabilities
- Linux Kernel (Aufs Filesystem Module)0 vulnerabilities
- Live Dvd0 vulnerabilities
CVE-2018-6557base-files_projectbase-files+3
EPSS score0.36%
The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.CVE-2013-2186debianlibcommons-fileupload-java+7EPSS score12.67%
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.CVE-2013-1070ubuntumetal_as_a_serviceEPSS score2.38%
Cross-site scripting (XSS) vulnerability in the API in Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/.CVE-2013-1069ubuntumetal_as_a_serviceEPSS score0.38%
Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file.CVE-2021-3939canonicalaccountsservice+3EPSS score0.37%
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.CVE-2021-3493canonicalubuntu_linux+52KEVEPSS score49.17%
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.CVE-2021-3492canonicalubuntu_linux+41EPSS score1.54%
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.CVE-2015-2285ubuntuupstart+1EPSS score1.01%
The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.CVE-2015-2150debianlinux+22EPSS score0.53%
Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.CVE-2015-1322canonicalubuntu_linux+2EPSS score0.53%
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).CVE-2015-1326debianpython-dbusmock+4EPSS score1.82%
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.CVE-2015-1343canonicalubuntu_linux+2EPSS score0.77%
All versions of unity-scope-gdrive logs search terms to syslog.CVE-2015-1341canonicalapport+3EPSS score0.43%
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.CVE-2015-1320canonicalmetal_as_a_service+2EPSS score0.87%
The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.CVE-2015-1316canonicaljuju+2EPSS score1.16%
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.CVE-2015-1327canonicalubuntu_linux+1EPSS score0.80%
Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.CVE-2015-1340github.com/lxclxd+2EPSS score0.90%
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.CVE-2015-5479ubuntulibav+3EPSS score1.98%
The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a file with crafted dimensions.CVE-2007-1351debianfreetype+15EPSS score5.59%
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.CVE-2007-1352debianlibxfont+12EPSS score1.52%
Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.