Canonical: Security Vulnerabilities
Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.
CVSS Score
6.8
EPSS Score
0.002
Published
2023-06-06
Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
CVSS Score
9.3
EPSS Score
0.002
Published
2023-06-06
Landscape allowed URLs which caused open redirection.
CVSS Score
6.1
EPSS Score
0.002
Published
2023-06-06
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
CVSS Score
4.4
EPSS Score
0.0
Published
2023-05-31
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
CVSS Score
5.5
EPSS Score
0.0
Published
2023-04-26
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
CVSS Score
5.5
EPSS Score
0.001
Published
2023-04-19
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
CVSS Score
5.5
EPSS Score
0.0
Published
2023-04-19
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.
CVSS Score
7.7
EPSS Score
0.037
Published
2023-04-13
It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service attack.
CVSS Score
4.4
EPSS Score
0.0
Published
2023-04-07
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.
CVSS Score
7.8
EPSS Score
0.003
Published
2023-03-27