Filtered by vendor Canonical Subscriptions
Total 4288 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-14347 4 Canonical, Debian, Redhat and 1 more 4 Ubuntu Linux, Debian Linux, Enterprise Linux and 1 more 2025-08-29 5.5 Medium
A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.
CVE-2020-14346 3 Canonical, Redhat, X.org 3 Ubuntu Linux, Enterprise Linux, X Server 2025-08-29 7.8 High
A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead to arbitrary access of memory contents. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2020-14362 3 Canonical, Redhat, X.org 3 Ubuntu Linux, Enterprise Linux, X Server 2025-08-29 7.8 High
A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2020-14361 3 Canonical, Redhat, X.org 3 Ubuntu Linux, Enterprise Linux, X Server 2025-08-29 7.8 High
A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2024-6388 1 Canonical 1 Ubuntu Advantage Desktop Daemon 2025-08-27 5.9 Medium
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
CVE-2024-6107 1 Canonical 2 Maas, Metal As A Service 2025-08-27 9.6 Critical
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
CVE-2024-6174 1 Canonical 1 Cloud-init 2025-08-26 8.8 High
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.
CVE-2024-6714 2 Canonical, Linux 2 Ubuntu Desktop Provision, Linux Kernel 2025-08-26 8.8 High
An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.
CVE-2025-5199 2 Apple, Canonical 2 Macos, Multipass 2025-08-26 7.3 High
In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup.
CVE-2022-28653 1 Canonical 1 Apport 2025-08-26 7.5 High
Users can consume unlimited disk space in /var/crash
CVE-2020-11936 1 Canonical 1 Apport 2025-08-26 3.1 Low
gdbus setgid privilege escalation
CVE-2022-1736 2 Canonical, Gnome 2 Ubuntu Linux, Gnome-remote-desktop 2025-08-26 9.8 Critical
Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.
CVE-2023-0092 1 Canonical 1 Juju 2025-08-26 4.9 Medium
An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.
CVE-2024-8037 1 Canonical 1 Juju 2025-08-26 6.5 Medium
Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.
CVE-2024-8038 1 Canonical 1 Juju 2025-08-26 7.9 High
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.
CVE-2024-9313 1 Canonical 1 Authd 2025-08-26 8.8 High
Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
CVE-2024-9312 2 Canonical, Ubuntu 2 Authd, Authd 2025-08-26 7.5 High
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.
CVE-2024-7558 1 Canonical 1 Juju 2025-08-26 8.7 High
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.
CVE-2024-11586 2 Canonical, Pulseaudio 2 Ubuntu Linux, Pulseaudio 2025-08-26 4 Medium
Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.
CVE-2024-6156 1 Canonical 1 Lxd 2025-08-26 3.8 Low
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.