Canonical Ltd.
51 CVEs across 21 Canonical Ltd. products. Browse Canonical Ltd. vulnerabilities, severities, and proof-of-concept exploits.
Canonical Ltd. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5616 | Medium | 4.9 | 2025-04-15 | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-se… |
CVE-2023-0092 | Medium | 4.9 | 2025-01-31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's file… |
CVE-2022-1736 | Critical | 9.8 | 2025-01-31 | Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. |
CVE-2020-11936 | Low | 3.1 | 2025-01-31 | gdbus setgid privilege escalation |
CVE-2022-28653 | High | 7.5 | 2025-01-31 | Users can consume unlimited disk space in /var/crash |
CVE-2024-6219 | Low | 3.8 | 2024-12-06 | Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honour… |
CVE-2024-6156 | Low | 3.8 | 2024-12-06 | Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. |
CVE-2024-11586 | Medium | 4.0 | 2024-11-23 | Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. |
CVE-2024-9312 | High | 7.5 | 2024-10-10 | Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another u… |
CVE-2024-9313 | High | 8.8 | 2024-10-03 | Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation wit… |
CVE-2024-8038 | High | 7.9 | 2024-10-02 | Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication loc… |
CVE-2024-8037 | Medium | 6.5 | 2024-10-02 | Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-8287 | High | 7.5 | 2024-09-18 | Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must b… |
CVE-2024-5290 | High | 8.8 | 2024-08-07 | An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate p… |
CVE-2024-6984 | High | 8.8 | 2024-07-29 | An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive dat… |
CVE-2024-6714 | High | 8.8 | 2024-07-23 | An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. |
CVE-2024-6388 | Medium | 5.9 | 2024-06-27 | Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an a… |
CVE-2020-27352 | Critical | 9.3 | 2024-06-21 | When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move pr… |
CVE-2022-4968 | Medium | 6.5 | 2024-06-07 | netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected. |
CVE-2022-28658 | Medium | 5.5 | 2024-06-04 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing |
CVE-2022-28657 | High | 7.8 | 2024-06-04 | Apport does not disable python crash handler before entering chroot |
CVE-2022-28656 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to consume RAM in the Apport process |
CVE-2022-28655 | High | 7.1 | 2024-06-04 | is_closing_session() allows users to create arbitrary tcp dbus connections |
CVE-2022-28654 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to fill up apport.log |
CVE-2022-28652 | Medium | 5.5 | 2024-06-04 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack |
CVE-2022-1242 | High | 7.8 | 2024-06-03 | Apport can be tricked into connecting to arbitrary sockets as the root user |
CVE-2022-0555 | High | 8.4 | 2024-06-03 | Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions |
CVE-2021-3899 | High | 7.8 | 2024-06-03 | There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as roo… |
CVE-2024-5138 | High | 8.1 | 2024-05-31 | The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was fo… |
CVE-2024-3250 | Medium | 6.5 | 2024-04-04 | It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local user… |
CVE-2023-49721 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2023-48733 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2022-4964 | Medium | 5.5 | 2024-01-24 | Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. |
CVE-2022-3328 | High | 7.8 | 2024-01-08 | Race condition in snap-confine's must_mkdir_and_open_with_perms() |
CVE-2023-5182 | Medium | 5.5 | 2023-10-07 | Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwo… |
CVE-2023-3297 | High | 8.1 | 2023-09-01 | In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the acco… |
CVE-2023-1523 | Critical | 10.0 | 2023-09-01 | Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary co… |
CVE-2023-32551 | Medium | 6.1 | 2023-06-06 | Landscape allowed URLs which caused open redirection. |
CVE-2023-32550 | Critical | 9.3 | 2023-06-06 | Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further… |
CVE-2023-32549 | Medium | 6.8 | 2023-06-06 | Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator. |
CVE-2023-2612 | Medium | 4.4 | 2023-05-31 | Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situatio… |
CVE-2023-1786 | Medium | 5.5 | 2023-04-26 | Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escal… |
CVE-2022-2084 | Medium | 5.5 | 2023-04-19 | Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed pass… |
CVE-2021-3429 | Medium | 5.5 | 2023-04-19 | When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var… |
CVE-2023-1326 | High | 7.7 | 2023-04-13 | A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unpri… |
CVE-2021-4120 | High | 8.2 | 2022-02-17 | snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor… |
CVE-2021-44731 | High | 7.8 | 2022-02-17 | A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain… |
CVE-2021-44730 | High | 7.8 | 2022-02-17 | snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap… |
CVE-2021-3155 | Low | 3.8 | 2022-02-17 | snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to re… |
CVE-2018-6559 | Low | 3.3 | 2018-10-26 | The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access… |