Canonical Ltd.

Products

Exploited and recent CVEs

• CVE-2023-5616 Medium 4.9 In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the lo 0.2%
• CVE-2023-0092 Medium 4.9 An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem. 0.6%
• CVE-2022-1736 Critical 9.8 Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. 0.7%
• CVE-2020-11936 Low 3.1 gdbus setgid privilege escalation 0.3%
• CVE-2022-28653 High 7.5 Users can consume unlimited disk space in /var/crash 0.4%
• CVE-2024-6219 Low 3.8 Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured. 0.2%
• CVE-2024-6156 Low 3.8 Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. 0.2%
• CVE-2024-11586 Medium 4.0 Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. 0.3%
• CVE-2024-9312 High 7.5 Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges. 0.3%
• CVE-2024-9313 High 8.8 Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them. 0.6%
• CVE-2024-8038 High 7.9 Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This ena 0.2%
• CVE-2024-8037 Medium 6.5 Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/v 0.2%
• CVE-2024-7558 High 8.7 JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an 0.5%
• CVE-2024-8287 High 7.5 Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox 0.2%
• CVE-2024-5290 High 8.8 An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant 0.7%
• CVE-2024-6984 High 8.8 An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local cha 0.4%
• CVE-2024-6714 High 8.8 An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. 0.3%
• CVE-2024-6388 Medium 5.9 Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext. 0.1%
• CVE-2020-27352 Critical 9.3 When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and m 0.3%
• CVE-2022-4968 Medium 6.5 netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected. 0.3%
• CVE-2022-28658 Medium 5.5 Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing 0.2%
• CVE-2022-28657 High 7.8 Apport does not disable python crash handler before entering chroot 0.2%
• CVE-2022-28656 Medium 5.5 is_closing_session() allows users to consume RAM in the Apport process 0.2%
• CVE-2022-28655 High 7.1 is_closing_session() allows users to create arbitrary tcp dbus connections 0.2%
• CVE-2022-28654 Medium 5.5 is_closing_session() allows users to fill up apport.log 0.3%
• CVE-2022-28652 Medium 5.5 ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack 0.2%
• CVE-2022-1242 High 7.8 Apport can be tricked into connecting to arbitrary sockets as the root user 0.2%
• CVE-2021-3899 High 7.8 There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root. 0.4%
• CVE-2022-0555 High 8.4 Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions 0.3%
• CVE-2024-5138 High 8.1 The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse c 0.8%