Canonical: Security Vulnerabilities
In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.
CVSS Score
4.9
EPSS Score
0.0
Published
2025-04-15
Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without the subsequent fixes that were introduced after this commit. The resolution of this CVE introduces those commits to the linux-bluefield package.
CVSS Score
7.5
EPSS Score
0.004
Published
2025-03-31
accountsservice no longer drops permissions when writting .pam_environment
CVSS Score
5.5
EPSS Score
0.001
Published
2025-03-25
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
CVSS Score
5.9
EPSS Score
0.629
Published
2025-02-28
gdbus setgid privilege escalation
CVSS Score
3.1
EPSS Score
0.002
Published
2025-01-31
Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.
CVSS Score
9.8
EPSS Score
0.005
Published
2025-01-31
An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.
CVSS Score
4.9
EPSS Score
0.005
Published
2025-01-31
Users can consume unlimited disk space in /var/crash
CVSS Score
7.5
EPSS Score
0.002
Published
2025-01-31
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
CVSS Score
3.8
EPSS Score
0.001
Published
2024-12-06
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
CVSS Score
3.8
EPSS Score
0.002
Published
2024-12-06