Canonical
Page 2 of 44 — Canonical CVEs from a corpus of 4344, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0881 | High | 7.5 | 2025-03-31 | Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without the subsequent fixes… |
CVE-2022-1804 | Medium | 5.5 | 2025-03-25 | accountsservice no longer drops permissions when writting .pam_environment |
CVE-2025-26466 | Medium | 5.9 | 2025-02-28 | A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of p… |
CVE-2023-0092 | Medium | 4.9 | 2025-01-31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's file… |
CVE-2022-1736 | Critical | 9.8 | 2025-01-31 | Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. |
CVE-2020-11936 | Low | 3.1 | 2025-01-31 | gdbus setgid privilege escalation |
CVE-2022-28653 | High | 7.5 | 2025-01-31 | Users can consume unlimited disk space in /var/crash |
CVE-2024-6219 | Low | 3.8 | 2024-12-06 | Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honour… |
CVE-2024-6156 | Low | 3.8 | 2024-12-06 | Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. |
CVE-2024-11586 | Medium | 4.0 | 2024-11-23 | Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. |
CVE-2024-9312 | High | 7.5 | 2024-10-10 | Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another u… |
CVE-2024-9313 | High | 8.8 | 2024-10-03 | Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation wit… |
CVE-2024-8038 | High | 7.9 | 2024-10-02 | Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication loc… |
CVE-2024-8037 | Medium | 6.5 | 2024-10-02 | Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-8287 | High | 7.5 | 2024-09-18 | Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must b… |
CVE-2024-0115 | Medium | 6.1 | 2024-08-12 | NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption… |
CVE-2024-5290 | High | 8.8 | 2024-08-07 | An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate p… |
CVE-2024-6984 | High | 8.8 | 2024-07-29 | An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive dat… |
CVE-2024-29069 | Medium | 4.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-s… |
CVE-2024-29068 | Medium | 5.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so ca… |
CVE-2024-1724 | Medium | 6.3 | 2024-07-25 | In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu… |
CVE-2024-6714 | High | 8.8 | 2024-07-23 | An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. |
CVE-2024-41129 | Medium | 4.4 | 2024-07-22 | The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of… |
CVE-2024-6773 | High | 8.8 | 2024-07-16 | Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2024-6388 | Medium | 5.9 | 2024-06-27 | Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an a… |
CVE-2020-27352 | Critical | 9.3 | 2024-06-21 | When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move pr… |
CVE-2024-0093 | Medium | 6.5 | 2024-06-13 | NVIDIA GPU software for Linux contains a vulnerability where it can expose sensitive information to an actor that is not explicitly authorized to have access t… |
CVE-2024-0092 | Medium | 5.5 | 2024-06-13 | NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper handling of exception conditions might lead to denial of s… |
CVE-2024-0091 | High | 7.8 | 2024-06-13 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API. A s… |
CVE-2024-0090 | High | 7.8 | 2024-06-13 | NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds write. A successful exploit of this vulnerability migh… |
CVE-2024-0086 | Medium | 5.5 | 2024-06-13 | NVIDIA vGPU software for Linux contains a vulnerability where the software can dereference a NULL pointer. A successful exploit of this vulnerability might lea… |
CVE-2024-0085 | Medium | 6.3 | 2024-06-13 | NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful expl… |
CVE-2024-0084 | High | 7.8 | 2024-06-13 | NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where the guest OS could execute privileged operations. A successful exploi… |
CVE-2022-4968 | Medium | 6.5 | 2024-06-07 | netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected. |
CVE-2022-28658 | Medium | 5.5 | 2024-06-04 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing |
CVE-2022-28657 | High | 7.8 | 2024-06-04 | Apport does not disable python crash handler before entering chroot |
CVE-2022-28656 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to consume RAM in the Apport process |
CVE-2022-28655 | High | 7.1 | 2024-06-04 | is_closing_session() allows users to create arbitrary tcp dbus connections |
CVE-2022-28654 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to fill up apport.log |
CVE-2022-28652 | Medium | 5.5 | 2024-06-04 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack |
CVE-2022-1242 | High | 7.8 | 2024-06-03 | Apport can be tricked into connecting to arbitrary sockets as the root user |
CVE-2022-0555 | High | 8.4 | 2024-06-03 | Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions |
CVE-2021-3899 | High | 7.8 | 2024-06-03 | There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as roo… |
CVE-2024-36392 | Medium | 6.1 | 2024-06-02 | MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-36391 | Critical | 9.1 | 2024-06-02 | MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic |
CVE-2024-36390 | High | 7.5 | 2024-06-02 | MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service |
CVE-2024-36389 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass |
CVE-2024-36388 | Critical | 10.0 | 2024-06-02 | MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function |
CVE-2024-27776 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE |
CVE-2024-5138 | High | 8.1 | 2024-05-31 | The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was fo… |
CVE-2024-5493 | High | 8.8 | 2024-05-30 | Heap buffer overflow in WebRTC in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2024-3250 | Medium | 6.5 | 2024-04-04 | It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local user… |
CVE-2023-49721 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2023-48733 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2022-4964 | Medium | 5.5 | 2024-01-24 | Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. |
CVE-2023-1032 | Medium | 4.7 | 2024-01-08 | The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in… |
CVE-2021-3600 | High | 7.8 | 2024-01-08 | It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod o… |
CVE-2022-3328 | High | 7.8 | 2024-01-08 | Race condition in snap-confine's must_mkdir_and_open_with_perms() |
CVE-2022-2602 | Medium | 5.3 | 2024-01-08 | io_uring UAF, Unix SCM garbage collection |
CVE-2022-2588 | Medium | 5.3 | 2024-01-08 | It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handl… |
CVE-2022-2586 | Medium | 5.3 | 2024-01-08 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. |
CVE-2022-2585 | Medium | 5.3 | 2024-01-08 | It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free. |
CVE-2023-5536 | Medium | 5.0 | 2023-12-12 | A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to… |
CVE-2023-45866 | Medium | 6.3 | 2023-12-08 | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboar… |
CVE-2023-31026 | Medium | 6.0 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to deni… |
CVE-2023-31022 | Medium | 5.5 | 2023-11-02 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of servi… |
CVE-2023-31021 | Medium | 5.5 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause… |
CVE-2023-31018 | Medium | 6.5 | 2023-11-02 | NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer derefere… |
CVE-2023-5182 | Medium | 5.5 | 2023-10-07 | Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwo… |
CVE-2023-4911 | High | 7.8 | 2023-10-03 | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a… |
CVE-2023-44216 | Medium | 5.3 | 2023-09-27 | PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing at… |
CVE-2023-3777 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_del… |
CVE-2023-3297 | High | 8.1 | 2023-09-01 | In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the acco… |
CVE-2023-1523 | Critical | 10.0 | 2023-09-01 | Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary co… |
CVE-2023-40283 | High | 7.8 | 2023-08-14 | An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children o… |
CVE-2023-32629 | High | 7.8 | 2023-07-26 | Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu… |
CVE-2023-2640 | High | 7.8 | 2023-07-26 | On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may… |
CVE-2023-3567 | High | 7.1 | 2023-07-24 | A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user ac… |
CVE-2023-24492 | Critical | 9.6 | 2023-07-11 | A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely execute code if a v… |
CVE-2023-31248 | High | 7.8 | 2023-07-05 | Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET… |
CVE-2023-3389 | High | 7.8 | 2023-06-28 | A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll re… |
CVE-2023-35788 | High | 7.8 | 2023-06-16 | An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classif… |
CVE-2023-32551 | Medium | 6.1 | 2023-06-06 | Landscape allowed URLs which caused open redirection. |
CVE-2023-32550 | Critical | 9.3 | 2023-06-06 | Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further… |
CVE-2023-32549 | Medium | 6.8 | 2023-06-06 | Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator. |
CVE-2023-2612 | Medium | 4.4 | 2023-05-31 | Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situatio… |
CVE-2023-1786 | Medium | 5.5 | 2023-04-26 | Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escal… |
CVE-2022-2084 | Medium | 5.5 | 2023-04-19 | Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed pass… |
CVE-2021-3429 | Medium | 5.5 | 2023-04-19 | When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var… |
CVE-2023-1326 | High | 7.7 | 2023-04-13 | A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unpri… |
CVE-2020-11935 | Medium | 4.4 | 2023-04-07 | It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause… |
CVE-2023-0179 | High | 7.8 | 2023-03-27 | A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses… |
CVE-2023-1380 | High | 7.1 | 2023-03-27 | A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issu… |
CVE-2023-0386 | High | 7.8 | 2023-03-22 | A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS… |
CVE-2022-44544 | Critical | 9.8 | 2022-11-06 | Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if t… |
CVE-2022-40617 | High | 7.5 | 2022-10-31 | strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) cer… |
CVE-2022-40277 | High | 7.8 | 2022-09-30 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Jopli… |
CVE-2022-41222 | High | 7.0 | 2022-09-21 | mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. |