These are the Ubuntu security notices that affect the current supported releases of Ubuntu. These notices are also posted to the ubuntu-security-announce mailing list (list archive). To report a security vulnerability in an Ubuntu package, please file a bug, or contact security@ubuntu.com. You may also be interested in learning about Ubuntu security policies. For more details on a specific CVE or source package, please see the Ubuntu CVE Tracker.
You can also view the latest notices by subscribing to the RSS 
or the Atom feeds.
USN-1831-1: OpenStack Nova vulnerability - 16th May 2013
Loganathan Parthipan discovered that Nova did not verify the size of QCOW2 instance storage. An authenticated attacker could exploit this to cause a denial of service by creating an image with a large virtual size with little data, then filling the virtual disk.
USN-1830-1: OpenStack Keystone vulnerability - 16th May 2013
Sam Stoelinga discovered that Keystone would not immediately invalidate tokens when deleting users via the v2 API. A deleted user would be able to continue to use resources until the token lifetime expired.
USN-1829-1: Linux kernel (EC2) vulnerabilities - 16th May 2013
Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6549) Mathias Krause discovered a flaw in xfrm_user in the Linux kernel. A local attacker with NET_ADMIN capability could ...
CVE-2012-6549 CVE-2013-1826 CVE-2013-1860 CVE-2013-1928 CVE-2013-2634
USN-1828-1: Linux kernel (Quantal HWE) vulnerability - 15th May 2013
An flaw was discovered in the Linux kernel's perf_events interface. A local user could exploit this flaw to escalate privileges on the system.
USN-1827-1: Linux kernel vulnerability - 15th May 2013
An flaw was discovered in the Linux kernel's perf_events interface. A local user could exploit this flaw to escalate privileges on the system.
USN-1826-1: Linux kernel vulnerability - 15th May 2013
An flaw was discovered in the Linux kernel's perf_events interface. A local user could exploit this flaw to escalate privileges on the system.
USN-1825-1: Linux kernel vulnerability - 15th May 2013
An flaw was discovered in the Linux kernel's perf_events interface. A local user could exploit this flaw to escalate privileges on the system.
USN-1824-1: Linux kernel vulnerabilities - 15th May 2013
Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6549) Mathias Krause discovered a flaw in xfrm_user in the Linux kernel. A local attacker with NET_ADMIN capability could ...
CVE-2012-6549 CVE-2013-1826 CVE-2013-1860 CVE-2013-1928 CVE-2013-2634
USN-1823-1: Thunderbird vulnerabilities - 14th May 2013
Multiple memory safety issues were discovered in Thunderbird. If the user were tricked into opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2013-0801, ...
CVE-2013-0801 CVE-2013-1669 CVE-2013-1670 CVE-2013-1674 CVE-2013-1675 CVE-2013-1676 CVE-2013-1677 CVE-2013-1678 CVE-2013-1679 CVE-2013-1680 CVE-2013-1681 LP: 1178649
USN-1822-1: Firefox vulnerabilities - 14th May 2013
Multiple memory safety issues were discovered in Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2013-0801, CVE-2013-1669) Cody Crews ...
CVE-2013-0801 CVE-2013-1669 CVE-2013-1670 CVE-2013-1671 CVE-2013-1674 CVE-2013-1675 CVE-2013-1676 CVE-2013-1677 CVE-2013-1678 CVE-2013-1679 CVE-2013-1680 CVE-2013-1681 LP: 1178277
USN-1821-1: telepathy-idle vulnerability - 9th May 2013
It was discovered that telepathy-idle did not perform any server certificate validation when using SSL connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information.
USN-1820-1: gpsd vulnerability - 8th May 2013
It was discovered that gpsd incorrectly handled certain malformed GPS data. An attacker could use this issue to cause gpsd to crash, resulting in a denial of service, or possibly execute arbitrary code.
USN-1819-1: OpenJDK 6 vulnerabilities - 7th May 2013
Ben Murphy discovered a vulnerability in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit this to execute arbitrary code. (CVE-2013-0401) James Forshaw discovered a vulnerability in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit this to execute ...
CVE-2013-0401 CVE-2013-1488 CVE-2013-1518 CVE-2013-1537 CVE-2013-1557 CVE-2013-1558 CVE-2013-1569 CVE-2013-2383 CVE-2013-2384 CVE-2013-2415 CVE-2013-2417 CVE-2013-2419 CVE-2013-2420 CVE-2013-2421 CVE-2013-2422 CVE-2013-2424 CVE-2013-2426 CVE-2013-2429 CVE-2013-2430 CVE-2013-2431
USN-1818-1: Mesa vulnerability - 7th May 2013
It was discovered that Mesa incorrectly handled certain arrays. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code.
USN-1817-1: libxml2 vulnerability - 7th May 2013
It was discovered that libxml2 incorrectly handled memory management when parsing certain XML files. An attacker could use this flaw to cause libxml2 to crash, resulting in a denial of service, or to possibly execute arbitrary code.
USN-1816-1: ClamAV vulnerabilities - 3rd May 2013
It was discovered that ClamAV would incorrectly parse a UPX-packed executable, leading to possible inappropriate heap reads. An attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-2020) It was discovered that ClamAV would incorrectly parse a PDF ...
USN-1815-1: Linux kernel vulnerabilities - 2nd May 2013
Andy Lutomirski discover an error in the Linux kernel's credential handling on unix sockets. A local user could exploit this flaw to gain administrative privileges. (CVE-2013-1979) Andy Lutomirski discovered a privilege escalation in the Linux kernel's user namespaces. A local user could exploit the flaw to gain administrative privileges. (CVE-2013-1959)
USN-1814-1: Linux kernel (OMAP4) vulnerabilities - 2nd May 2013
Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548) Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could ...
CVE-2012-6548 CVE-2012-6549 CVE-2013-0913 CVE-2013-1848 CVE-2013-1860 CVE-2013-2634 CVE-2013-2635
USN-1813-1: Linux kernel vulnerabilities - 2nd May 2013
Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548) Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could ...
CVE-2012-6548 CVE-2012-6549 CVE-2013-0913 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 CVE-2013-1848 CVE-2013-1860 CVE-2013-2634 CVE-2013-2635
USN-1812-1: Linux kernel (Quantal HWE) vulnerabilities - 1st May 2013
Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548) Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could ...
CVE-2012-6548 CVE-2012-6549 CVE-2013-0913 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 CVE-2013-1848 CVE-2013-1860 CVE-2013-2634 CVE-2013-2635
USN-1811-1: Linux kernel (OMAP4) vulnerabilities - 1st May 2013
Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548) Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could ...
CVE-2012-6548 CVE-2012-6549 CVE-2013-0913 CVE-2013-1848 CVE-2013-1860 CVE-2013-2634 CVE-2013-2635
USN-1809-1: Linux kernel vulnerabilities - 1st May 2013
Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548) Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could ...
CVE-2012-6548 CVE-2012-6549 CVE-2013-0913 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 CVE-2013-1848 CVE-2013-1860 CVE-2013-2634 CVE-2013-2635
USN-1807-2: MySQL vulnerabilities - 25th April 2013
USN-1807-1 fixed vulnerabilities in MySQL. This update provides MySQL 5.5.31 for Ubuntu 13.04. Original advisory details: Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.1.69 in Ubuntu 10.04 LTS and Ubuntu 11.10. Ubuntu 12.04 ...
CVE-2012-0553 CVE-2013-1492 CVE-2013-1502 CVE-2013-1506 CVE-2013-1511 CVE-2013-1512 CVE-2013-1521 CVE-2013-1523 CVE-2013-1526 CVE-2013-1532 CVE-2013-1544 CVE-2013-1552 CVE-2013-1555 CVE-2013-1623 CVE-2013-2375 CVE-2013-2376 CVE-2013-2378 CVE-2013-2389 CVE-2013-2391 CVE-2013-2392
USN-1808-1: Linux kernel (EC2) vulnerabilities - 25th April 2013
Mathias Krause discovered an information leak in the Linux kernel's getsockname implementation for Logical Link Layer (llc) sockets. A local user could exploit this flaw to examine some of the kernel's stack memory. (CVE-2012-6542) Mathias Krause discovered information leaks in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol ...
CVE-2012-6542 CVE-2012-6544 CVE-2012-6545 CVE-2012-6546 CVE-2012-6548 CVE-2013-0228 CVE-2013-0349 CVE-2013-1774 CVE-2013-1796
USN-1807-1: MySQL vulnerabilities - 24th April 2013
Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.1.69 in Ubuntu 10.04 LTS and Ubuntu 11.10. Ubuntu 12.04 LTS and Ubuntu 12.10 have been updated to MySQL 5.5.31. In addition to security fixes, the ...
CVE-2012-0553 CVE-2013-1492 CVE-2013-1502 CVE-2013-1506 CVE-2013-1511 CVE-2013-1512 CVE-2013-1521 CVE-2013-1523 CVE-2013-1526 CVE-2013-1532 CVE-2013-1544 CVE-2013-1552 CVE-2013-1555 CVE-2013-1623 CVE-2013-2375 CVE-2013-2376 CVE-2013-2378 CVE-2013-2389 CVE-2013-2391 CVE-2013-2392
USN-1804-2: IcedTea-Web regression - 23rd April 2013
USN-1804-1 fixed vulnerabilities in IcedTea-Web. This update introduced a regression with the Java Network Launching Protocol (JNLP) when fetching content over SSL under certain configurations, such as when using the community-supported IcedTead 7 browser plugin. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jiri Vanek ...
USN-1806-1: OpenJDK 7 vulnerabilities - 23rd April 2013
Ben Murphy discovered a vulnerability in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit this to execute arbitrary code. (CVE-2013-0401) James Forshaw discovered a vulnerability in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit this to execute ...
CVE-2013-0401 CVE-2013-1488 CVE-2013-1518 CVE-2013-1537 CVE-2013-1557 CVE-2013-1558 CVE-2013-1569 CVE-2013-2383 CVE-2013-2384 CVE-2013-2415 CVE-2013-2417 CVE-2013-2419 CVE-2013-2420 CVE-2013-2421 CVE-2013-2422 CVE-2013-2423 CVE-2013-2424 CVE-2013-2426 CVE-2013-2429 CVE-2013-2430 CVE-2013-2431 CVE-2013-2436
USN-1805-1: Linux kernel vulnerabilities - 19th April 2013
Mathias Krause discovered an information leak in the Linux kernel's getsockname implementation for Logical Link Layer (llc) sockets. A local user could exploit this flaw to examine some of the kernel's stack memory. (CVE-2012-6542) Mathias Krause discovered information leaks in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol ...
CVE-2012-6542 CVE-2012-6544 CVE-2012-6545 CVE-2012-6546 CVE-2012-6548 CVE-2013-0228 CVE-2013-0349 CVE-2013-1774 CVE-2013-1796
USN-1804-1: IcedTea-Web vulnerabilities - 18th April 2013
Jiri Vanek discovered that IcedTea-Web would use the same classloader for applets from different domains. A remote attacker could exploit this to expose sensitive information or potentially manipulate applets from other domains. (CVE-2013-1926) It was discovered that IcedTea-Web did not properly verify JAR files and was susceptible to the GIFAR ...
USN-1803-1: X.Org X server vulnerability - 17th April 2013
It was discovered that the X.Org X server did not properly clear input events in certain circumstances. A local attacker with physical access could use this flaw to capture keystrokes.
USN-1802-1: Samba vulnerability - 16th April 2013
It was discovered that Samba incorrectly handled CIFS share attributes when SMB2 was used. A remote authenticated user could possibly gain write access to certain shares, bypassing the intended permissions.
USN-1801-1: curl vulnerability - 15th April 2013
YAMADA Yasuharu discovered that libcurl was vulnerable to a cookie leak when doing requests across domains with matching tails. curl did not properly restrict cookies to domains and subdomains. If a user or automated system were tricked into processing a specially crafted URL, an attacker could read cookie values stored ...
USN-1800-1: HAProxy vulnerabilities - 15th April 2013
It was discovered that HAProxy incorrectly handled configurations where global.tune.bufsize was set to a value higher than the default. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2012-2942) Yves Lafon discovered that HAProxy incorrectly handled HTTP keywords in TCP inspection ...
USN-1799-1: NVIDIA graphics drivers vulnerability - 10th April 2013
It was discovered that the NVIDIA graphics drivers incorrectly handled large ARGB cursors. A local attacker could use this issue to gain root privileges. The NVIDIA graphics drivers have been updated to 304.88 to fix this issue. In addition to the security fix, the updated packages contain bug fixes, new ...
USN-1798-1: Linux kernel (EC2) vulnerabilities - 8th April 2013
Mathias Krause discovered several errors in the Linux kernel's xfrm_user implementation. A local attacker could exploit these flaws to examine parts of kernel memory. (CVE-2012-6537) Mathias Krause discovered information leak in the Linux kernel's compat ioctl interface. A local user could exploit the flaw to examine parts of kernel stack ...
CVE-2012-6537 CVE-2012-6539 CVE-2012-6540 CVE-2013-0914 CVE-2013-1767 CVE-2013-1792
USN-1797-1: Linux kernel (OMAP4) vulnerabilities - 8th April 2013
Andrew Jones discovered a flaw with the xen_iret function in Linux kernel's Xen virtualizeation. In the 32-bit Xen paravirt platform an unprivileged guest OS user could exploit this flaw to cause a denial of service (crash the system) or gain guest OS privilege. (CVE-2013-0228) Emese Revfy discovered that in the ...
CVE-2013-0228 CVE-2013-0914 CVE-2013-1767 CVE-2013-1792 CVE-2013-2546 CVE-2013-2547 CVE-2013-2548
USN-1796-1: Linux kernel vulnerabilities - 8th April 2013
Andrew Jones discovered a flaw with the xen_iret function in Linux kernel's Xen virtualizeation. In the 32-bit Xen paravirt platform an unprivileged guest OS user could exploit this flaw to cause a denial of service (crash the system) or gain guest OS privilege. (CVE-2013-0228) Emese Revfy discovered that in the ...
CVE-2013-0228 CVE-2013-0914 CVE-2013-1767 CVE-2013-1792 CVE-2013-2546 CVE-2013-2547 CVE-2013-2548
USN-1795-1: Linux kernel (Quantal HWE) vulnerabilities - 8th April 2013
Andrew Jones discovered a flaw with the xen_iret function in Linux kernel's Xen virtualizeation. In the 32-bit Xen paravirt platform an unprivileged guest OS user could exploit this flaw to cause a denial of service (crash the system) or gain guest OS privilege. (CVE-2013-0228) Emese Revfy discovered that in the ...
CVE-2013-0228 CVE-2013-0914 CVE-2013-1767 CVE-2013-1792 CVE-2013-2546 CVE-2013-2547 CVE-2013-2548
USN-1794-1: Linux kernel (OMAP4) vulnerabilities - 8th April 2013
Emese Revfy discovered that in the Linux kernel signal handlers could leak address information across an exec, making it possible to by pass ASLR (Address Space Layout Randomization). A local user could use this flaw to by pass ASLR to reliably deliver an exploit payload that would otherwise be stopped ...
CVE-2013-0914 CVE-2013-1767 CVE-2013-1792 CVE-2013-2546 CVE-2013-2547 CVE-2013-2548
USN-1793-1: Linux kernel vulnerabilities - 8th April 2013
Emese Revfy discovered that in the Linux kernel signal handlers could leak address information across an exec, making it possible to by pass ASLR (Address Space Layout Randomization). A local user could use this flaw to by pass ASLR to reliably deliver an exploit payload that would otherwise be stopped ...
CVE-2013-0914 CVE-2013-1767 CVE-2013-1792 CVE-2013-2546 CVE-2013-2547 CVE-2013-2548
USN-1792-1: Linux kernel vulnerabilities - 8th April 2013
Mathias Krause discovered several errors in the Linux kernel's xfrm_user implementation. A local attacker could exploit these flaws to examine parts of kernel memory. (CVE-2012-6537) Mathias Krause discovered information leak in the Linux kernel's compat ioctl interface. A local user could exploit the flaw to examine parts of kernel stack ...
CVE-2012-6537 CVE-2012-6539 CVE-2012-6540 CVE-2013-0914 CVE-2013-1767 CVE-2013-1792
USN-1791-1: Thunderbird vulnerabilities - 8th April 2013
Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan Sreckovic and Joe Drew discovered multiple memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or ...
CVE-2013-0788 CVE-2013-0791 CVE-2013-0793 CVE-2013-0795 CVE-2013-0796 CVE-2013-0800 LP: 1162043
USN-1786-2: Unity Firefox Extension update - 4th April 2013
USN-1786-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Unity Firefox Extension. Original advisory details: Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan Sreckovic, Joe Drew, Andrew McCreight, Randell Jesup, Gary Kwong and Mats Palmgren discovered multiple memory safety issues affecting Firefox. If the user were ...
USN-1790-1: Libav vulnerabilities - 4th April 2013
It was discovered that Libav incorrectly handled certain malformed media files. If a user were tricked into opening a crafted media file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program.
CVE-2013-0894 CVE-2013-2277 CVE-2013-2495 CVE-2013-2496
USN-1786-1: Firefox vulnerabilities - 4th April 2013
Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan Sreckovic, Joe Drew, Andrew McCreight, Randell Jesup, Gary Kwong and Mats Palmgren discovered multiple memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of ...
CVE-2013-0788 CVE-2013-0789 CVE-2013-0791 CVE-2013-0792 CVE-2013-0793 CVE-2013-0794 CVE-2013-0795 CVE-2013-0796 CVE-2013-0800 LP: 1161422
USN-1789-1: PostgreSQL vulnerabilities - 4th April 2013
Mitsumasa Kondo and Kyotaro Horiguchi discovered that PostgreSQL incorrectly handled certain connection requests containing database names starting with a dash. A remote attacker could use this flaw to damage or destroy files within a server's data directory. This issue only applied to Ubuntu 11.10, Ubuntu 12.04 LTS, and Ubuntu 12.10. ...
CVE-2013-1899 CVE-2013-1900 CVE-2013-1901
USN-1788-1: Linux kernel (Oneiric backport) vulnerabilities - 3rd April 2013
Emese Revfy discovered that in the Linux kernel signal handlers could leak address information across an exec, making it possible to bypass ASLR (Address Space Layout Randomization). A local user could use this flaw to bypass ASLR to reliably deliver an exploit payload that would otherwise be stopped (by ASLR). ...
CVE-2013-0914 CVE-2013-1767 CVE-2013-1792
USN-1787-1: Linux kernel vulnerabilities - 2nd April 2013
Emese Revfy discovered that in the Linux kernel signal handlers could leak address information across an exec, making it possible to by pass ASLR (Address Space Layout Randomization). A local user could use this flaw to by pass ASLR to reliably deliver an exploit payload that would otherwise be stopped ...
CVE-2013-0914 CVE-2013-1767 CVE-2013-1792
USN-1785-1: poppler vulnerabilities - 2nd April 2013
It was discovered that poppler contained multiple security issues when parsing malformed PDF documents. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program.
CVE-2013-1788 CVE-2013-1789 CVE-2013-1790
USN-1784-1: libxslt vulnerability - 2nd April 2013
Nicholas Gregoire discovered that libxslt incorrectly handled certain empty values. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial of service.