CVE reports

The Common Vulnerabilities and Exposures (CVE) system is used to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. Canonical keeps track of all CVEs affecting Ubuntu, and releases a security notice when an issue is fixed. You can find additional guidance for high-profile vulnerabilities in the Ubuntu Vulnerability Knowledge Base section

Search CVEs

By Ubuntu release

Recent CVEs

CVE-2017-2624

Negligible priority

Some fixes available 4 of 10

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp()...

10 affected packages

xorg-server, xorg-server-hwe-16.04, xorg-server-lts-quantal, xorg-server-lts-raring, xorg-server-lts-saucy...

CVE-2015-3418

Medium priority

Some fixes available 5 of 9

The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial of service (divide-by-zero and crash) via a zero-height PutImage request.

6 affected packages

xorg-server, xorg-server-lts-quantal, xorg-server-lts-raring, xorg-server-lts-saucy, xorg-server-lts-trusty, xorg-server-lts-utopic

CVE-2015-3164

Medium priority

Ignored

The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.

7 affected packages

xorg-server, xorg-server-lts-quantal, xorg-server-lts-raring, xorg-server-lts-saucy, xorg-server-lts-trusty...

CVE-2015-0255

Medium priority

Some fixes available 30 of 44

X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value...

7 affected packages

vnc4, xorg-server, xorg-server-lts-quantal, xorg-server-lts-raring, xorg-server-lts-saucy...

CVE-2014-8103

Medium priority

Some fixes available 4 of 5

X.Org Server (aka xserver and xorg-server) 1.15.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or...

2 affected packages