UBports vulnerabilities

Products

• lomiri-download-manager 2
• unity8 2
• ubuntu touch 1

Latest UBports CVEs

Newest publication first

1. CVE-2026-96425 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

   Published 2026-10-16

   Medium·CVSS 5.5 EPSS 0.11%

   Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

2. CVE-2026-96424 Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

   Published 2026-10-16

   High·CVSS 7.8 EPSS 0.11%

   Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

3. CVE-2014-1423 Online Accounts Signon daemon gives out all oauth tokens to any app

   Published 2020-05-07

   Medium·CVSS 5.5 EPSS 0.84%

   signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app...

4. CVE-2015-7946 MTP service exposed during emergency dialer

   Published 2020-05-07

   Medium·CVSS 4.6 EPSS 0.37%

   Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.

5. CVE-2016-1573 Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash

   Published 2019-04-22

   High·CVSS 7.8 EPSS 0.43%

   Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.