Canonical Security Advisories · December 2022 — Canonical Security Advisories
52 advisories 99 CVEs 2 EXPLOITED

Ubuntu Security Notices (USN-NNNN-N) for 2022-12. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 2 are already weaponised in the wild — see the Exploited section.

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

Advisories

USN-5760-2

USNExploitedVulnCheck KEV listedCRITICAL2022-12-05

libxml2 vulnerabilities

CVEs:CVE-2022-40303CVE-2022-40304

Affected products

ProductStatusVendorPackageEcosystem
libxml2 affected Ubuntu:Pro:16.04:LTS libxml2
libxml2 affected Ubuntu:Pro:14.04:LTS libxml2
Upstream advisory

USN-5760-1

USNExploitedVulnCheck KEV listedCRITICAL2022-12-05

libxml2 vulnerabilities

CVEs:CVE-2022-2309CVE-2022-40303CVE-2022-40304

Affected products

ProductStatusVendorPackageEcosystem
libxml2 affected Ubuntu:18.04:LTS libxml2
libxml2 affected Ubuntu:22.04:LTS libxml2
libxml2 affected Ubuntu:20.04:LTS libxml2
Upstream advisory

USN-5753-1

USNWeaponized exploitHIGH2022-12-01

snapd vulnerability

CVEs:CVE-2022-3328

Affected products

ProductStatusVendorPackageEcosystem
snapd affected Ubuntu:22.04:LTS snapd
snapd affected Ubuntu:Pro:16.04:LTS snapd
snapd affected Ubuntu:18.04:LTS snapd
snapd affected Ubuntu
snapd affected Ubuntu:20.04:LTS snapd
Upstream advisory

USN-5253-1

USNActive exploitation (sightings)HIGH2022-12-13

ruby-rack vulnerabilities

CVEs:CVE-2019-16782CVE-2020-8184CVE-2022-30122CVE-2022-30123

Affected products

ProductStatusVendorPackageEcosystem
ruby-rack affected Ubuntu:Pro:20.04:LTS ruby-rack
ruby-rack affected Ubuntu:Pro:16.04:LTS ruby-rack
ruby-rack affected Ubuntu:Pro:18.04:LTS ruby-rack
ruby-rack affected Ubuntu:Pro:14.04:LTS ruby-rack
Upstream advisory

USN-5755-1

USNPoC exploitHIGH2022-12-01

linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities

CVEs:CVE-2022-3524CVE-2022-3564CVE-2022-3565CVE-2022-3566CVE-2022-3567CVE-2022-3594CVE-2022-3621CVE-2022-42703CVE-2022-43945

Affected products

ProductStatusVendorPackageEcosystem
linux affected Ubuntu:22.04:LTS linux
linux-aws affected Ubuntu:22.04:LTS linux-aws
linux-aws-5.15 affected Ubuntu:20.04:LTS linux-aws-5.15
linux-gcp affected Ubuntu:22.04:LTS linux-gcp
linux-gkeop affected Ubuntu:22.04:LTS linux-gkeop
linux-hwe-5.15 affected Ubuntu:20.04:LTS linux-hwe-5.15
linux-ibm affected Ubuntu:22.04:LTS linux-ibm
linux-intel-iotg affected Ubuntu:22.04:LTS linux-intel-iotg
linux-kvm affected Ubuntu:22.04:LTS linux-kvm
linux-lowlatency affected Ubuntu:22.04:LTS linux-lowlatency
linux-lowlatency-hwe-5.15 affected Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15
linux-oracle affected Ubuntu:22.04:LTS linux-oracle
linux-oracle-5.15 affected Ubuntu:20.04:LTS linux-oracle-5.15
linux-raspi affected Ubuntu:22.04:LTS linux-raspi
Upstream advisory

USN-5767-1

USNPoC exploitCRITICAL2022-12-08

python2.7, python3.10, python3.6, python3.8 vulnerabilities

CVEs:CVE-2022-37454CVE-2022-45061

Affected products

ProductStatusVendorPackageEcosystem
python2.7 affected Ubuntu:18.04:LTS python2.7
python3.10 affected Ubuntu:22.04:LTS python3.10
python3.6 affected Ubuntu:18.04:LTS python3.6
python3.8 affected Ubuntu:20.04:LTS python3.8
Upstream advisory

USN-5767-2

USNPoC exploitHIGH2022-12-08

python2.7, python3.5 vulnerability

CVEs:CVE-2022-45061

Affected products

ProductStatusVendorPackageEcosystem
python2.7 affected Ubuntu:Pro:16.04:LTS python2.7
python2.7 affected Ubuntu:Pro:14.04:LTS python2.7
python3.5 affected Ubuntu:Pro:16.04:LTS python3.5
Upstream advisory

USN-5758-1

USNPoC exploitHIGH2022-12-01

linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities

CVEs:CVE-2022-3239CVE-2022-3524CVE-2022-3564CVE-2022-3565CVE-2022-3566CVE-2022-3567CVE-2022-3594CVE-2022-3621CVE-2022-3635CVE-2022-3649CVE-2022-40768CVE-2022-42703CVE-2022-43750

Affected products

ProductStatusVendorPackageEcosystem
linux affected Ubuntu:Pro:16.04:LTS linux
linux-aws affected Ubuntu:Pro:16.04:LTS linux-aws
linux-aws affected Ubuntu:Pro:14.04:LTS linux-aws
linux-kvm affected Ubuntu:Pro:16.04:LTS linux-kvm
linux-lts-xenial affected Ubuntu:Pro:14.04:LTS linux-lts-xenial
Upstream advisory

USN-5757-2

USNPoC exploitHIGH2022-12-01

linux-aws-hwe, linux-gcp, linux-hwe, linux-oracle vulnerabilities

CVEs:CVE-2022-3239CVE-2022-3524CVE-2022-3564CVE-2022-3565CVE-2022-3566CVE-2022-3567CVE-2022-3594CVE-2022-3621CVE-2022-42703

Affected products

ProductStatusVendorPackageEcosystem
linux-aws-hwe affected Ubuntu:Pro:16.04:LTS linux-aws-hwe
linux-gcp affected Ubuntu:Pro:16.04:LTS linux-gcp
linux-hwe affected Ubuntu:Pro:16.04:LTS linux-hwe
linux-oracle affected Ubuntu:Pro:16.04:LTS linux-oracle
Upstream advisory

USN-5757-1

USNPoC exploitHIGH2022-12-01

linux, linux-aws, linux-dell300x, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

CVEs:CVE-2022-3239CVE-2022-3524CVE-2022-3564CVE-2022-3565CVE-2022-3566CVE-2022-3567CVE-2022-3594CVE-2022-3621CVE-2022-42703

Affected products

ProductStatusVendorPackageEcosystem
linux affected Ubuntu:18.04:LTS linux
linux-aws affected Ubuntu:18.04:LTS linux-aws
linux-dell300x affected Ubuntu:18.04:LTS linux-dell300x
linux-gcp-4.15 affected Ubuntu:18.04:LTS linux-gcp-4.15
linux-kvm affected Ubuntu:18.04:LTS linux-kvm
linux-oracle affected Ubuntu:18.04:LTS linux-oracle
linux-raspi2 affected Ubuntu:18.04:LTS linux-raspi2
linux-snapdragon affected Ubuntu:18.04:LTS linux-snapdragon
Upstream advisory

USN-5756-1

USNPoC exploitHIGH2022-12-01

linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities

CVEs:CVE-2022-3524CVE-2022-3564CVE-2022-3565CVE-2022-3566CVE-2022-3567CVE-2022-3594CVE-2022-3621CVE-2022-42703

Affected products

ProductStatusVendorPackageEcosystem
linux affected Ubuntu:20.04:LTS linux
linux-aws affected Ubuntu:20.04:LTS linux-aws
linux-aws-5.4 affected Ubuntu:18.04:LTS linux-aws-5.4
linux-gcp affected Ubuntu:20.04:LTS linux-gcp
linux-gcp-5.4 affected Ubuntu:18.04:LTS linux-gcp-5.4
linux-gkeop affected Ubuntu:20.04:LTS linux-gkeop
linux-hwe-5.4 affected Ubuntu:18.04:LTS linux-hwe-5.4
linux-ibm affected Ubuntu:20.04:LTS linux-ibm
linux-ibm-5.4 affected Ubuntu:18.04:LTS linux-ibm-5.4
linux-kvm affected Ubuntu:20.04:LTS linux-kvm
linux-oracle affected Ubuntu:20.04:LTS linux-oracle
linux-oracle-5.4 affected Ubuntu:18.04:LTS linux-oracle-5.4
linux-raspi affected Ubuntu:20.04:LTS linux-raspi
linux-raspi-5.4 affected Ubuntu:18.04:LTS linux-raspi-5.4
Upstream advisory

USN-5783-1

USNPoC exploitCRITICAL2022-12-16

linux-oem-5.17 vulnerability

CVEs:CVE-2022-42896

Affected products

ProductStatusVendorPackageEcosystem
linux-oem-5.17 affected Ubuntu:22.04:LTS linux-oem-5.17
Upstream advisory

USN-5765-1

USNPoC exploitNONE2022-12-07

postgresql-9.5 vulnerability

CVEs:CVE-2021-23222

Affected products

ProductStatusVendorPackageEcosystem
postgresql-9.5 affected Ubuntu:Pro:16.04:LTS postgresql-9.5
Upstream advisory

USN-5743-2

USNPoC exploitHIGH2022-12-01

tiff vulnerability

CVEs:CVE-2022-3970

Affected products

ProductStatusVendorPackageEcosystem
tiff affected Ubuntu:18.04:LTS tiff
tiff affected Ubuntu:22.04:LTS tiff
tiff affected Ubuntu:20.04:LTS tiff
Upstream advisory

UBUNTU-CVE-2020-36632

USNPoC exploitCRITICAL2022-12-25

CVEs:CVE-2020-36632

Affected products

ProductStatusVendorPackageEcosystem
qt6-webengine affected Ubuntu:24.04:LTS qt6-webengine
qt6-webengine affected Ubuntu:25.10 qt6-webengine
qt6-webengine affected Ubuntu:22.04:LTS qt6-webengine
Upstream advisory

USN-5770-1

USNPoC exploit2022-12-08

gcc-5, gccgo-6 vulnerability

CVEs:CVE-2017-11671

Affected products

ProductStatusVendorPackageEcosystem
gcc-5 affected Ubuntu:Pro:16.04:LTS gcc-5
gccgo-6 affected Ubuntu:Pro:16.04:LTS gccgo-6
Upstream advisory

USN-5778-1

USNCoalition ESS < 30%CRITICAL2022-12-14

xorg-server, xorg-server-hwe-18.04, xwayland vulnerabilities

CVEs:CVE-2022-4283CVE-2022-46340CVE-2022-46341CVE-2022-46342CVE-2022-46343CVE-2022-46344

Affected products

ProductStatusVendorPackageEcosystem
xorg-server affected Ubuntu:20.04:LTS xorg-server
xorg-server affected Ubuntu:18.04:LTS xorg-server
xorg-server affected Ubuntu:22.04:LTS xorg-server
xorg-server-hwe-18.04 affected Ubuntu:18.04:LTS xorg-server-hwe-18.04
xwayland affected Ubuntu:22.04:LTS xwayland
Upstream advisory

USN-5766-1

USNCoalition ESS < 30%HIGH2022-12-07

heimdal vulnerability

CVEs:CVE-2022-41916

Affected products

ProductStatusVendorPackageEcosystem
heimdal affected Ubuntu:Pro:16.04:LTS heimdal
heimdal affected Ubuntu:20.04:LTS heimdal
heimdal affected Ubuntu:18.04:LTS heimdal
heimdal affected Ubuntu:Pro:14.04:LTS heimdal
Upstream advisory

UBUNTU-CVE-2020-36619

USNCoalition ESS < 30%CRITICAL2022-12-19

CVEs:CVE-2020-36619

Affected products

ProductStatusVendorPackageEcosystem
multimon-ng affected Ubuntu:20.04:LTS multimon-ng
multimon-ng affected Ubuntu:22.04:LTS multimon-ng
Upstream advisory

USN-5781-1

USNCoalition ESS < 30%CRITICAL2022-12-14

emacs24 vulnerability

CVEs:CVE-2022-45939

Affected products

ProductStatusVendorPackageEcosystem
emacs24 affected Ubuntu:Pro:16.04:LTS emacs24
Upstream advisory

UBUNTU-CVE-2020-36627

USNCoalition ESS < 30%MEDIUM2022-12-25

CVEs:CVE-2020-36627

Affected products

ProductStatusVendorPackageEcosystem
golang-github-go-macaron-i18n affected Ubuntu:22.04:LTS golang-github-go-macaron-i18n
golang-github-go-macaron-i18n affected Ubuntu:18.04:LTS golang-github-go-macaron-i18n
golang-github-go-macaron-i18n affected Ubuntu:20.04:LTS golang-github-go-macaron-i18n
Upstream advisory

USN-5762-1

USNCoalition ESS < 30%CRITICAL2022-12-05

binutils vulnerability

CVEs:CVE-2022-38533

Affected products

ProductStatusVendorPackageEcosystem
binutils affected Ubuntu:Pro:16.04:LTS binutils
binutils affected Ubuntu:20.04:LTS binutils
binutils affected Ubuntu:18.04:LTS binutils
binutils affected Ubuntu:22.04:LTS binutils
Upstream advisory

UBUNTU-CVE-2021-28429

USNCoalition ESS < 30%MEDIUM2022-12-06

CVEs:CVE-2021-28429

Affected products

ProductStatusVendorPackageEcosystem
ffmpeg affected Ubuntu:18.04:LTS ffmpeg
ffmpeg affected Ubuntu:Pro:16.04:LTS ffmpeg
ffmpeg affected Ubuntu:20.04:LTS ffmpeg
Upstream advisory

UBUNTU-CVE-2015-10005

USNEPSS <= 49%HIGH2022-12-27

CVEs:CVE-2015-10005

Affected products

ProductStatusVendorPackageEcosystem
node-markdown-it affected Ubuntu:25.10 node-markdown-it
node-markdown-it affected Ubuntu:22.04:LTS node-markdown-it
node-markdown-it affected Ubuntu:24.04:LTS node-markdown-it
Upstream advisory

UBUNTU-CVE-2019-25085

USNEPSS <= 49%HIGH2022-12-26

CVEs:CVE-2019-25085

Affected products

ProductStatusVendorPackageEcosystem
epiphany-browser affected Ubuntu:20.04:LTS epiphany-browser
epiphany-browser affected Ubuntu:18.04:LTS epiphany-browser
glib2.0 affected Ubuntu:20.04:LTS glib2.0
glib2.0 affected Ubuntu:22.04:LTS glib2.0
glib2.0 affected Ubuntu:18.04:LTS glib2.0
Upstream advisory

UBUNTU-CVE-2017-20151

USNEPSS <= 49%CRITICAL2022-12-30

CVEs:CVE-2017-20151

Affected products

ProductStatusVendorPackageEcosystem
libitext-java affected Ubuntu:25.10 libitext-java
libitext-java affected Ubuntu:24.04:LTS libitext-java
libitext-java affected Ubuntu:22.04:LTS libitext-java
libitext-java affected Ubuntu:18.04:LTS libitext-java
libitext-java affected Ubuntu:20.04:LTS libitext-java
libitext-java affected Ubuntu:16.04:LTS libitext-java
Upstream advisory

UBUNTU-CVE-2018-25050

USNEPSS <= 49%MEDIUM2022-12-28

CVEs:CVE-2018-25050

Affected products

ProductStatusVendorPackageEcosystem
libjs-chosen affected Ubuntu:18.04:LTS libjs-chosen
libjs-chosen affected Ubuntu:20.04:LTS libjs-chosen
libjs-chosen affected Ubuntu:16.04:LTS libjs-chosen
libjs-chosen affected Ubuntu:22.04:LTS libjs-chosen
libjs-chosen affected Ubuntu:24.04:LTS libjs-chosen
libjs-chosen affected Ubuntu:25.10 libjs-chosen
Upstream advisory

UBUNTU-CVE-2018-25060

USNEPSS <= 49%HIGH2022-12-30

CVEs:CVE-2018-25060

Affected products

ProductStatusVendorPackageEcosystem
golang-github-go-macaron-csrf affected Ubuntu:22.04:LTS golang-github-go-macaron-csrf
golang-github-go-macaron-csrf affected Ubuntu:20.04:LTS golang-github-go-macaron-csrf
golang-github-go-macaron-csrf affected Ubuntu:18.04:LTS golang-github-go-macaron-csrf
Upstream advisory

UBUNTU-CVE-2019-25078

USNEPSS <= 49%HIGH2022-12-13

CVEs:CVE-2019-25078

Affected products

ProductStatusVendorPackageEcosystem
pacparser affected Ubuntu:22.04:LTS pacparser
pacparser affected Ubuntu:16.04:LTS pacparser
pacparser affected Ubuntu:20.04:LTS pacparser
pacparser affected Ubuntu:18.04:LTS pacparser
Upstream advisory

USN-5777-2

USNAll remaining2022-12-14

pillow-python2 vulnerabilities

Affected products

ProductStatusVendorPackageEcosystem
pillow-python2 affected Ubuntu:Pro:20.04:LTS pillow-python2
Upstream advisory

USN-5777-1

USNAll remaining2022-12-13

pillow vulnerabilities

Affected products

ProductStatusVendorPackageEcosystem
pillow affected Ubuntu:22.04:LTS pillow
pillow affected Ubuntu:20.04:LTS pillow
Upstream advisory

USN-5771-1

USNAll remainingHIGH2022-12-12

squid3 regression

Affected products

ProductStatusVendorPackageEcosystem
squid3 affected Ubuntu:Pro:16.04:LTS squid3
Upstream advisory

USN-5763-1

USNAll remaining2022-12-07

numpy vulnerabilities

Affected products

ProductStatusVendorPackageEcosystem
numpy affected Ubuntu:22.04:LTS numpy
numpy affected Ubuntu:20.04:LTS numpy
Upstream advisory

USN-5761-2

USNAll remaining2022-12-06

ca-certificates update

Affected products

ProductStatusVendorPackageEcosystem
ca-certificates affected Ubuntu:Pro:14.04:LTS ca-certificates
ca-certificates affected Ubuntu:Pro:16.04:LTS ca-certificates
Upstream advisory

USN-5761-1

USNAll remaining2022-12-05

ca-certificates update

Affected products

ProductStatusVendorPackageEcosystem
ca-certificates affected Ubuntu:20.04:LTS ca-certificates
ca-certificates affected Ubuntu:18.04:LTS ca-certificates
ca-certificates affected Ubuntu:22.04:LTS ca-certificates
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.