Canonical: Security Vulnerabilities
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
CVSS Score
7.1
EPSS Score
0.0
Published
2023-07-24
A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely execute code if a victim user opens an attacker-crafted link and accepts further prompts.
CVSS Score
9.6
EPSS Score
0.003
Published
2023-07-11
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
CVSS Score
7.8
EPSS Score
0.002
Published
2023-07-05
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.
Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer.
We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).
CVSS Score
7.8
EPSS Score
0.0
Published
2023-06-28
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.
CVSS Score
7.8
EPSS Score
0.0
Published
2023-06-16
Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.
CVSS Score
6.8
EPSS Score
0.002
Published
2023-06-06
Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
CVSS Score
9.3
EPSS Score
0.002
Published
2023-06-06
Landscape allowed URLs which caused open redirection.
CVSS Score
6.1
EPSS Score
0.002
Published
2023-06-06
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
CVSS Score
4.4
EPSS Score
0.0
Published
2023-05-31
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
CVSS Score
5.5
EPSS Score
0.0
Published
2023-04-26