Canonical vulnerabilities
224 CVEs and advisories name Canonical as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-5290An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged att
- CVE-2024-6984An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access
- CVE-2024-29069snapd will follow archived symlinks when unpacking a filesystem
- CVE-2024-29068snapd non-regular file indefinite blocking read
- CVE-2024-1724snapd allows $HOME/bin symlink
- CVE-2024-6714An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.
- CVE-2024-41129The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
- CVE-2024-6388Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passin
- CVE-2020-27352When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result s
- CVE-2022-4968netplan leaks the private key of wireguard to local users.
- CVE-2022-28658Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing
- CVE-2022-28657Apport does not disable python crash handler before entering chroot
- CVE-2022-28656is_closing_session() allows users to consume RAM in the Apport process
- CVE-2022-28655is_closing_session() allows users to create arbitrary tcp dbus connections
- CVE-2022-28654is_closing_session() allows users to fill up apport.log
- CVE-2022-28652~/.config/apport/settings parsing is vulnerable to "billion laughs" attack
- CVE-2022-1242Apport can be tricked into connecting to arbitrary sockets as the root user
- CVE-2021-3899There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute ar
- CVE-2022-0555Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
- CVE-2024-5138The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of
- CVE-2024-3250It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unpr
- CVE-2023-49721An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD.
- CVE-2023-48733An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2.
- CVE-2022-4964Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.
- CVE-2022-3328Race condition in snap-confine's must_mkdir_and_open_with_perms()
- CVE-2023-5536A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate
- CVE-2023-5182Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier.
- CVE-2023-3297In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus
- CVE-2023-1523Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to
- CVE-2023-32629Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_