Ubuntu 12.x — End of Life
EOL Actively exploited EOL: May 16, 20142 releases in this series47 CVEs
Ubuntu 12.x reached end of life on May 16, 2014, 4543 days ago, and no longer receives security fixes. The most recent release in this series is 12.10. 47 CVEs are tracked for this series, including 8 critical and 3 actively exploited according to CISA KEV. 29 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is Ubuntu 13. See Ubuntu 13 →
Ubuntu 12.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 12.10 | Oct 18, 2012 | May 16, 2014 | May 16, 2014 | 12.10 | EOL | |
| 12.04LTS | Apr 26, 2012 | Apr 28, 2017 | Apr 28, 2017 | 12.04.5 | EOL |
CVEs affecting Ubuntu 12.x (50)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 12.10 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 12.04 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 12.04 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 12.04 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 12.04 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 12.04 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 12.04 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.11% | — | 12.04 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 12.04 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-18197 | HIGH | 7.5 | 4.36% | — | 12.04 | In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the rel… | Oct 18, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 12.04 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16168 | MEDIUM | 6.5 | 4.25% | — | 12.04 | In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missin… | Sep 9, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 12.04 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-13118 | MEDIUM | 5.3 | 5.05% | — | 12.04 | In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an in… | Jul 1, 2019 |
| CVE-2019-13117 | MEDIUM | 5.3 | 6.28% | — | 12.04 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumb… | Jul 1, 2019 |
| CVE-2019-10160 | CRITICAL | 9.8 | 5.22% | — | 12.04 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af… | Jun 7, 2019 |
| CVE-2019-11068 | CRITICAL | 9.8 | 5.23% | — | 12.04 | libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permi… | Apr 10, 2019 |
| CVE-2019-9948 | CRITICAL | 9.1 | 11.84% | — | 12.04 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypas… | Mar 23, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 12.04 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2018-14647 | HIGH | 7.5 | 10.91% | — | 12.04 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy… | Sep 25, 2018 |
| CVE-2018-1000802 | CRITICAL | 9.8 | 20.12% | — | 12.04 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements u… | Sep 18, 2018 |
| CVE-2018-10902 | HIGH | 7.8 | 0.52% | — | 12.04 | It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc … | Aug 21, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 12.04 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 12.04 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2018-0732 | HIGH | 7.5 | 48.83% | — | 12.04 | During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime v… | Jun 12, 2018 |
| CVE-2018-3639 | MEDIUM | 5.5 | 60.63% | — | 12.04 | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres… | May 22, 2018 |
| CVE-2018-11212 | MEDIUM | 6.5 | 4.83% | — | 12.04 | An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a … | May 16, 2018 |
| CVE-2018-1000030 | LOW | 3.6 | 1.18% | — | 12.04 | Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 … | Feb 8, 2018 |
| CVE-2017-5753 | MEDIUM | 5.6 | 93.83% | — | 12.04 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of … | Jan 4, 2018 |
| CVE-2017-12617 | HIGH | 8.1 | 99.96% | KEV | 12.04 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT… | Oct 4, 2017 |
| CVE-2016-10165 | HIGH | 7.1 | 2.76% | — | 12.04 | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive informati… | Feb 3, 2017 |
| CVE-2016-3092 | HIGH | 7.5 | 37.17% | — | 12.04 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x bef… | Jul 4, 2016 |
| CVE-2016-4472 | HIGH | 8.1 | 11.94% | — | 12.04 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke… | Jun 30, 2016 |
| CVE-2016-0718 | CRITICAL | 9.8 | 13.33% | — | 12.04 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m… | May 26, 2016 |
| CVE-2015-8325 | HIGH | 7.8 | 0.60% | — | 12.04 | The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is… | May 1, 2016 |
| CVE-2016-0763 | MEDIUM | 6.3 | 11.29% | — | 12.04 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.… | Feb 25, 2016 |
| CVE-2016-0714 | HIGH | 8.8 | 13.07% | — | 12.04 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x… | Feb 25, 2016 |
| CVE-2016-0706 | MEDIUM | 4.3 | 6.23% | — | 12.04 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache… | Feb 25, 2016 |
| CVE-2016-0494 | CRITICAL | 10.0 | 7.21% | — | 12.04 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Jav… | Jan 21, 2016 |
| CVE-2016-0483 | CRITICAL | 10.0 | 14.71% | — | 12.04 | Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows rem… | Jan 21, 2016 |
| CVE-2016-0466 | MEDIUM | 5.0 | 5.45% | — | 12.04 | Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u… | Jan 21, 2016 |
| CVE-2016-0448 | MEDIUM | 4.0 | 3.53% | — | 12.04 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Ja… | Jan 21, 2016 |
| CVE-2016-0402 | MEDIUM | 5.0 | 4.64% | — | 12.04 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Jav… | Jan 21, 2016 |
| CVE-2015-5477 | HIGH | 7.5 | 99.40% | KEV | 12.04 | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (… | Jul 29, 2015 |
| CVE-2015-4000 | LOW | 3.7 | 99.86% | — | 12.04 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro… | May 21, 2015 |
| CVE-2015-2808 | LOW | 3.7 | 73.85% | — | 12.04 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data duri… | Apr 1, 2015 |
| CVE-2013-0335 | HIGH | 7.6 | 2.14% | — | 12.04 | OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access t… | Mar 22, 2013 |
| CVE-2013-0335 | HIGH | 7.6 | 2.14% | — | 12.10 | OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access t… | Mar 22, 2013 |
| CVE-2013-2566 | MEDIUM | 5.9 | 84.42% | — | 12.10 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for … | Mar 15, 2013 |
| CVE-2013-2566 | MEDIUM | 5.9 | 84.42% | — | 12.04 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for … | Mar 15, 2013 |
Ubuntu 12.x is EOL — migrate to Ubuntu 13.x
Ubuntu 13.x is the next major release. Plan your upgrade before Ubuntu 12.x stops receiving security patches.
Add a Ubuntu 12 EOL badge to your README
Show your users which Ubuntu version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/ubuntu/12)Frequently asked questions
Is Ubuntu 12 end of life?
Yes. All Ubuntu 12.x releases have reached end of life and no longer receive security patches. There are 47 known CVEs affecting Ubuntu 12.x, including 8 critical. Migrate to Ubuntu 13.x as soon as possible.
What CVEs affect Ubuntu 12?
There are 47 CVEs tracked for Ubuntu 12.x, including 8 critical severity issues and 3 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Ubuntu 12 version?
The latest Ubuntu 12.x patch release is 12.10, released on October 18, 2012. Always run the latest patch to benefit from all security fixes.
How to migrate from Ubuntu 12 to Ubuntu 13?
To migrate from Ubuntu 12 to Ubuntu 13: (1) review the official Ubuntu 13 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Ubuntu 12 in production?
No. Ubuntu 12 has reached end of life and security vulnerabilities are no longer patched. Critically, 3 CVEs affecting Ubuntu 12.x are in the CISA KEV catalog — meaning they are actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA