Ubuntu
138 CVEs across 41 Ubuntu products. Browse Ubuntu vulnerabilities, severities, and proof-of-concept exploits.
Ubuntu products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6862 | Medium | 5.5 | 2026-04-22 | A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4… |
CVE-2026-3497 | High | 7.5 | 2026-03-12 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distrib… |
CVE-2025-6966 | Medium | 5.5 | 2025-12-05 | NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via… |
CVE-2025-7044 | High | 7.7 | 2025-12-03 | An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update we… |
CVE-2025-2486 | High | 8.8 | 2025-11-26 | The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot… |
CVE-2023-0881 | High | 7.5 | 2025-03-31 | Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without the subsequent fixes… |
CVE-2022-1804 | Medium | 5.5 | 2025-03-25 | accountsservice no longer drops permissions when writting .pam_environment |
CVE-2020-11935 | Medium | 4.4 | 2023-04-07 | It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause… |
CVE-2021-3939 | High | 7.8 | 2021-11-17 | Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static… |
CVE-2021-3493 | High | 8.8 | 2021-04-17 | The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an unde… |
CVE-2021-3492 | High | 8.8 | 2021-04-17 | Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. Thes… |
CVE-2020-27347 | High | 8.8 | 2020-11-06 | In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by termin… |
CVE-2020-15708 | Critical | 9.3 | 2020-11-06 | Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary fi… |
CVE-2020-15707 | Medium | 5.7 | 2020-07-29 | Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and… |
CVE-2020-15706 | Medium | 6.4 | 2020-07-29 | GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whil… |
CVE-2020-15705 | Medium | 6.4 | 2020-07-29 | GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel sig… |
CVE-2014-1423 | Medium | 5.9 | 2020-05-07 | signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect check… |
CVE-2019-15794 | High | 7.1 | 2020-04-24 | Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file… |
CVE-2019-15793 | Medium | 6.5 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group i… |
CVE-2019-15792 | High | 7.1 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), the… |
CVE-2019-15791 | High | 7.1 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referenc… |
CVE-2020-8832 | Medium | 5.5 | 2020-04-10 | The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain I… |
CVE-2019-15796 | Medium | 4.7 | 2020-03-26 | Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache… |
CVE-2019-15795 | Medium | 4.7 | 2020-03-26 | python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and… |
CVE-2012-2092 | Medium | 5.9 | 2019-12-06 | A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature. |
CVE-2019-7307 | High | 7.0 | 2019-08-29 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability… |
CVE-2019-11476 | Medium | 6.5 | 2019-08-29 | An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap alloca… |
CVE-2016-1587 | High | 7.1 | 2019-04-22 | The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the orig… |
CVE-2016-1586 | Low | 1.8 | 2019-04-22 | A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before… |
CVE-2016-1584 | Low | 1.6 | 2019-04-22 | In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input. |
CVE-2016-1579 | Medium | 6.7 | 2019-04-22 | UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was n… |
CVE-2016-1573 | High | 7.8 | 2019-04-22 | Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a… |
CVE-2015-1343 | Low | 2.0 | 2019-04-22 | All versions of unity-scope-gdrive logs search terms to syslog. |
CVE-2015-1341 | High | 7.4 | 2019-04-22 | Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport befor… |
CVE-2015-1340 | High | 7.0 | 2019-04-22 | LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic l… |
CVE-2015-1327 | Low | 3.9 | 2019-04-22 | Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app ha… |
CVE-2015-1326 | Medium | 5.7 | 2019-04-22 | python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious… |
CVE-2015-1320 | Medium | 5.5 | 2019-04-22 | The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versio… |
CVE-2015-1316 | Medium | 6.4 | 2019-04-22 | Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key. |
CVE-2014-1428 | Low | 2.0 | 2019-04-22 | A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affects Ubuntu MAAS versions prior to 1.9.2. |
CVE-2014-1427 | Critical | 9.6 | 2019-04-22 | A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MA… |
CVE-2014-1426 | High | 8.6 | 2019-04-22 | A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS… |
CVE-2018-6557 | High | 7.0 | 2018-08-21 | The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary fi… |
CVE-2017-14461 | Medium | 5.9 | 2018-03-02 | A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information di… |
CVE-2015-5479 | Medium | 6.5 | 2016-04-19 | The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and… |
CVE-2015-1322 | | 2015-04-29 | Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1… | |
CVE-2015-2285 | | 2015-03-12 | The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to exe… | |
CVE-2015-2150 | | 2015-03-12 | Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to… | |
CVE-2014-1424 | | 2014-11-24 | apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, rel… | |
CVE-2013-1070 | | 2014-02-17 | Cross-site scripting (XSS) vulnerability in the API in Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 allows remote attackers to inject arbitrary web script or H… | |
CVE-2013-1069 | | 2014-02-17 | Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication cr… | |
CVE-2011-4613 | | 2014-02-05 | The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local u… | |
CVE-2013-2186 | | 2013-10-28 | The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server… | |
CVE-2011-1842 | | 2011-05-03 | dbus_backend/lsd.py in the D-Bus backend in language-selector before 0.6.7 does not validate the arguments to the (1) SetSystemDefaultLangEnv and (2) SetSystem… | |
CVE-2011-0729 | | 2011-04-29 | dbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not restrict access on the basis of a PolicyKit check result, which al… | |
CVE-2011-0724 | | 2011-02-19 | The Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private keys after installation, which causes each installation to hav… | |
CVE-2010-0834 | | 2010-08-10 | The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, do… | |
CVE-2009-2939 | | 2009-09-21 | The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which migh… | |
CVE-2009-1296 | | 2009-06-09 | The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to… | |
CVE-2009-1601 | | 2009-05-11 | The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working directory to the c… | |
CVE-2008-6792 | | 2009-05-07 | system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and conse… | |
CVE-2009-1573 | | 2009-05-06 | xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows… | |
CVE-2009-1295 | | 2009-04-30 | Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the appli… | |
CVE-2009-0578 | | 2009-03-05 | GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or rem… | |
CVE-2009-0365 | | 2009-03-05 | nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection password… | |
CVE-2006-7236 | | 2009-01-02 | The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to exe… | |
CVE-2008-5104 | | 2008-11-17 | Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.1… | |
CVE-2008-5103 | | 2008-11-17 | The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! arg… | |
CVE-2008-4395 | | 2008-11-06 | Multiple buffer overflows in the ndiswrapper module 1.53 for the Linux kernel 2.6 allow remote attackers to execute arbitrary code by sending packets over a lo… | |
CVE-2008-4306 | | 2008-11-04 | Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence. | |
CVE-2008-2808 | | 2008-07-07 | Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings, which allows remote attackers to… | |
CVE-2008-2285 | | 2008-05-18 | The ssh-vulnkey tool on Ubuntu Linux 7.04, 7.10, and 8.04 LTS does not recognize authorized_keys lines that contain options, which makes it easier for remote a… | |
CVE-2008-0172 | | 2008-01-17 | The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers… | |
CVE-2006-7229 | High | 7.5 | 2007-11-15 | The skge driver 1.5 in Linux kernel 2.6.15 on Ubuntu does not properly use the spin_lock and spin_unlock functions, which allows remote attackers to cause a de… |
CVE-2007-3920 | | 2007-10-29 | GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical access to take contro… | |
CVE-2007-5365 | | 2007-10-11 | Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dh… | |
CVE-2007-5159 | | 2007-10-01 | The ntfs-3g package before 1.913-2.fc7 in Fedora 7, and an ntfs-3g package in Ubuntu 7.10/Gutsy, assign incorrect permissions (setuid root) to mount.ntfs-3g, w… | |
CVE-2007-4137 | | 2007-09-18 | Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service (crash) via a crafte… | |
CVE-2007-4601 | | 2007-08-30 | A regression error in tcp-wrappers 7.6.dbs-10 and 7.6.dbs-11 might allow remote attackers to bypass intended access restrictions when a service uses libwrap bu… | |
CVE-2007-2637 | | 2007-05-13 | MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors. | |
CVE-2007-1352 | | 2007-04-06 | Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long fir… | |
CVE-2007-1351 | | 2007-04-06 | Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenti… | |
CVE-2007-1463 | | 2007-03-21 | Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, wh… | |
CVE-2006-5877 | | 2007-02-23 | The enigmail extension before 0.94.2 does not properly handle large, encrypted file e-mail attachments, which allows remote attackers to cause a denial of serv… | |
CVE-2006-5649 | Medium | 5.5 | 2006-12-14 | Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a de… |
CVE-2006-5648 | Medium | 5.5 | 2006-12-14 | Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys… |
CVE-2006-6235 | | 2006-12-07 | A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via cr… | |
CVE-2006-5466 | | 2006-11-06 | Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, m… | |
CVE-2006-3597 | | 2006-07-18 | passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the fi… | |
CVE-2006-3378 | | 2006-07-06 | passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the return code of a setuid call, which might… | |
CVE-2006-1183 | | 2006-03-13 | The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permission… | |
CVE-2006-0151 | | 2006-01-09 | sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a… | |
CVE-2005-3626 | | 2005-12-31 | Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash)… | |
CVE-2005-3625 | | 2005-12-31 | Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinit… | |
CVE-2005-3624 | | 2005-12-31 | The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to co… | |
CVE-2005-0106 | | 2005-05-03 | SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to… | |
CVE-2005-0988 | | 2005-05-02 | Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard lin… | |
CVE-2005-0080 | | 2005-05-02 | The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed… | |
CVE-2005-0077 | | 2005-05-02 | The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file. | |
CVE-2005-0206 | | 2005-04-27 | The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such a… |