{ "summary": { "snap": { "added": [], "removed": [], "diff": [ "core22", "lxd" ] }, "deb": { "added": [], "removed": [], "diff": [ "apt", "apt-utils", "bind9-dnsutils", "bind9-host", "bind9-libs:riscv64", "ca-certificates", "distro-info-data", "libapt-pkg6.0:riscv64", "libbrotli1:riscv64", "libglib2.0-0:riscv64", "libglib2.0-bin", "libglib2.0-data", "liblzma5:riscv64", "libnss3:riscv64", "libpcre2-8-0:riscv64", "nano", "python3-twisted", "snapd", "tmux", "ubuntu-advantage-tools", "ubuntu-pro-client", "ubuntu-pro-client-l10n", "xfsprogs", "xz-utils" ] } }, "diff": { "deb": [ { "name": "apt", "from_version": { "source_package_name": "apt", "source_package_version": "2.4.14", "version": "2.4.14" }, "to_version": { "source_package_name": "apt", "source_package_version": "2.4.15ubuntu0.1", "version": "2.4.15ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Download verification bypass", " - methods/*.cc: Open target files exclusively", " - CVE-2026-109518", " * SECURITY UPDATE: Out-of-bounds accesses", " - deb: guard against unsigned underflow when trimming control newlines", " - gpgv: don't advance past the null terminator in PushEntryWithKeyID", " - debDebFileParser: reject .deb without a Version field", " - srvrec: reject res_query answers bigger than our buffer", " - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check", " * Test suite reliability:", " - test: Limit valgrind to 1024 open files", "" ], "package": "apt", "version": "2.4.15ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 02 Nov 2026 13:56:44 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "apt-utils", "from_version": { "source_package_name": "apt", "source_package_version": "2.4.14", "version": "2.4.14" }, "to_version": { "source_package_name": "apt", "source_package_version": "2.4.15ubuntu0.1", "version": "2.4.15ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Download verification bypass", " - methods/*.cc: Open target files exclusively", " - CVE-2026-109518", " * SECURITY UPDATE: Out-of-bounds accesses", " - deb: guard against unsigned underflow when trimming control newlines", " - gpgv: don't advance past the null terminator in PushEntryWithKeyID", " - debDebFileParser: reject .deb without a Version field", " - srvrec: reject res_query answers bigger than our buffer", " - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check", " * Test suite reliability:", " - test: Limit valgrind to 1024 open files", "" ], "package": "apt", "version": "2.4.15ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 02 Nov 2026 13:56:44 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.7", "version": "1:9.18.39-0ubuntu0.22.04.7" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.8", "version": "1:9.18.39-0ubuntu0.22.04.8" }, "cves": [ { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Amplified resource exhaustion in inbound message processing", " - debian/patches/CVE-2026-19630.patch: Limit how many compression pointers a", " message may make us follow in lib/dns/compress.c,", " lib/dns/include/dns/compress.h, lib/dns/include/dns/name.h,", " lib/dns/message.c, lib/dns/name.c, tests/dns/message_test.c,", " tests/dns/name_test.c, tests/dns/rdata_test.c.", " - CVE-2026-19630", " * SECURITY UPDATE: Concurrent GSS-TSIG messages corrupt memory", " - debian/patches/CVE-2026-94300.patch: Serialize access to the shared GSS-", " TSIG security context in bin/tests/system/tsiggss/tests_gss_context.py,", " lib/dns/gssapi_link.c.", " - CVE-2026-94300", " * SECURITY UPDATE: named may terminate unexpectedly when a redirect zone is", " used with strict QNAME minimization", " - debian/patches/CVE-2026-96888-1.patch: Clear AD flag on redirect NXRRSET", " in lib/ns/query.c.", " - debian/patches/CVE-2026-96888-2.patch: Handle qname-minimization failures", " gracefully when redirecting in lib/ns/query.c.", " - CVE-2026-96888", " * SECURITY UPDATE: Specific RPZ configurations and query patterns may result", " in an unexpected exit", " - debian/patches/CVE-2026-97313-1.patch: Add a reproducer for CVE-2026-97313", " in bin/tests/system/rpzrecurse/ans7/ans.py,", " bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns2/db.nsdname,", " bin/tests/system/rpzrecurse/ns2/db.rpzip,", " bin/tests/system/rpzrecurse/ns2/named.cve-2026-97313.conf,", " bin/tests/system/rpzrecurse/tests.sh.", " - debian/patches/CVE-2026-97313-2.patch: Test view and RPZ matching after", " UDP client reuse in bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns8/named.args,", " bin/tests/system/rpzrecurse/ns8/named.conf.j2,", " bin/tests/system/rpzrecurse/ns8/nonrecursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/recursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/root.hint,", " bin/tests/system/rpzrecurse/tests_client_reuse.py.", " - debian/patches/CVE-2026-97313-3.patch: Tighten the conditions of the", " 'recursionok' flag reset in lib/ns/query.c.", " - CVE-2026-97313", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 30 Oct 2026 11:28:24 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.7", "version": "1:9.18.39-0ubuntu0.22.04.7" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.8", "version": "1:9.18.39-0ubuntu0.22.04.8" }, "cves": [ { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Amplified resource exhaustion in inbound message processing", " - debian/patches/CVE-2026-19630.patch: Limit how many compression pointers a", " message may make us follow in lib/dns/compress.c,", " lib/dns/include/dns/compress.h, lib/dns/include/dns/name.h,", " lib/dns/message.c, lib/dns/name.c, tests/dns/message_test.c,", " tests/dns/name_test.c, tests/dns/rdata_test.c.", " - CVE-2026-19630", " * SECURITY UPDATE: Concurrent GSS-TSIG messages corrupt memory", " - debian/patches/CVE-2026-94300.patch: Serialize access to the shared GSS-", " TSIG security context in bin/tests/system/tsiggss/tests_gss_context.py,", " lib/dns/gssapi_link.c.", " - CVE-2026-94300", " * SECURITY UPDATE: named may terminate unexpectedly when a redirect zone is", " used with strict QNAME minimization", " - debian/patches/CVE-2026-96888-1.patch: Clear AD flag on redirect NXRRSET", " in lib/ns/query.c.", " - debian/patches/CVE-2026-96888-2.patch: Handle qname-minimization failures", " gracefully when redirecting in lib/ns/query.c.", " - CVE-2026-96888", " * SECURITY UPDATE: Specific RPZ configurations and query patterns may result", " in an unexpected exit", " - debian/patches/CVE-2026-97313-1.patch: Add a reproducer for CVE-2026-97313", " in bin/tests/system/rpzrecurse/ans7/ans.py,", " bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns2/db.nsdname,", " bin/tests/system/rpzrecurse/ns2/db.rpzip,", " bin/tests/system/rpzrecurse/ns2/named.cve-2026-97313.conf,", " bin/tests/system/rpzrecurse/tests.sh.", " - debian/patches/CVE-2026-97313-2.patch: Test view and RPZ matching after", " UDP client reuse in bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns8/named.args,", " bin/tests/system/rpzrecurse/ns8/named.conf.j2,", " bin/tests/system/rpzrecurse/ns8/nonrecursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/recursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/root.hint,", " bin/tests/system/rpzrecurse/tests_client_reuse.py.", " - debian/patches/CVE-2026-97313-3.patch: Tighten the conditions of the", " 'recursionok' flag reset in lib/ns/query.c.", " - CVE-2026-97313", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 30 Oct 2026 11:28:24 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs:riscv64", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.7", "version": "1:9.18.39-0ubuntu0.22.04.7" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.8", "version": "1:9.18.39-0ubuntu0.22.04.8" }, "cves": [ { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Amplified resource exhaustion in inbound message processing", " - debian/patches/CVE-2026-19630.patch: Limit how many compression pointers a", " message may make us follow in lib/dns/compress.c,", " lib/dns/include/dns/compress.h, lib/dns/include/dns/name.h,", " lib/dns/message.c, lib/dns/name.c, tests/dns/message_test.c,", " tests/dns/name_test.c, tests/dns/rdata_test.c.", " - CVE-2026-19630", " * SECURITY UPDATE: Concurrent GSS-TSIG messages corrupt memory", " - debian/patches/CVE-2026-94300.patch: Serialize access to the shared GSS-", " TSIG security context in bin/tests/system/tsiggss/tests_gss_context.py,", " lib/dns/gssapi_link.c.", " - CVE-2026-94300", " * SECURITY UPDATE: named may terminate unexpectedly when a redirect zone is", " used with strict QNAME minimization", " - debian/patches/CVE-2026-96888-1.patch: Clear AD flag on redirect NXRRSET", " in lib/ns/query.c.", " - debian/patches/CVE-2026-96888-2.patch: Handle qname-minimization failures", " gracefully when redirecting in lib/ns/query.c.", " - CVE-2026-96888", " * SECURITY UPDATE: Specific RPZ configurations and query patterns may result", " in an unexpected exit", " - debian/patches/CVE-2026-97313-1.patch: Add a reproducer for CVE-2026-97313", " in bin/tests/system/rpzrecurse/ans7/ans.py,", " bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns2/db.nsdname,", " bin/tests/system/rpzrecurse/ns2/db.rpzip,", " bin/tests/system/rpzrecurse/ns2/named.cve-2026-97313.conf,", " bin/tests/system/rpzrecurse/tests.sh.", " - debian/patches/CVE-2026-97313-2.patch: Test view and RPZ matching after", " UDP client reuse in bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns8/named.args,", " bin/tests/system/rpzrecurse/ns8/named.conf.j2,", " bin/tests/system/rpzrecurse/ns8/nonrecursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/recursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/root.hint,", " bin/tests/system/rpzrecurse/tests_client_reuse.py.", " - debian/patches/CVE-2026-97313-3.patch: Tighten the conditions of the", " 'recursionok' flag reset in lib/ns/query.c.", " - CVE-2026-97313", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 30 Oct 2026 11:28:24 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260601~22.04.1", "version": "20260601~22.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.22.04.2", "version": "20260816ubuntu0.22.04.2" }, "cves": [], "launchpad_bugs_fixed": [ 2061817, 2171507 ], "changes": [ { "cves": [], "log": [ "", " * debian/ca-certificates.postinst: only populate /etc/ssl/certs without", " running the hooks on initial installs. On upgrades, running", " update-ca-certificates synchronously with an empty hooksdir consumed", " the pending changes, so the deferred update-ca-certificates trigger", " reported \"0 added, 0 removed\" and the hooks in", " /etc/ca-certificates/update.d (ca-certificates-java,", " ca-certificates-mono) were never told which certificates were added", " or removed. Their keystores drifted from the system trust store and", " kept trusting CAs removed from /etc/ssl/certs, including the eMudhra", " root blacklisted in 20260816ubuntu0.22.04.1 (LP: #2061817,", " Debian #1069251).", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.22.04.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2061817 ], "author": "Vyom Yadav ", "date": "Thu, 22 Oct 2026 18:52:38 +0530" }, { "cves": [], "log": [ "", " * Blacklist the following CA cert due to intermediate cert compromise", " (LP: #2171507)", " + \"emSign ECC Root CA - G3\"", " * Update Mozilla certificate authority bundle to version 2.90", " The following certificate authorities were added (+):", " + \"SECOM TLS ECC Root CA 2024\"", " + \"SECOM TLS RSA Root CA 2024\"", " + \"Telia EC TLS Root CA v3\"", " + \"Telia RSA TLS Root CA v3\"", " The following certificate authorities were removed (-):", " - \"Atos TrustedRoot 2011\"", " - \"Entrust Root Certification Authority\"", " - \"SecureSign Root CA12\"", " - \"ePKI Root Certification Authority\"", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2171507 ], "author": "Marc Deslauriers ", "date": "Tue, 20 Oct 2026 09:03:26 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "0.72-0ubuntu0.22.04.1", "version": "0.72-0ubuntu0.22.04.1" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "2026.10.12-0ubuntu0.22.04.1", "version": "2026.10.12-0ubuntu0.22.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2170573 ], "changes": [ { "cves": [], "log": [ "", " * New data update release", " - Correct Debian codename Experimental to RC-Buggy", " - Support testing against the installed data", " - Switch to calendar versioning (CalVer)", " - Add Ubuntu 27.04 \"Tenacious T-Rex\" (LP: #2170573)", " - Makefile: Clean .pyc files and mypy cache", " * Apply patch to revert correcting Debian codename Experimental to RC-Buggy,", " because this change breaks the distro-info test case and dgit (see #2168892)", " * autopkgtest:", " - test against the installed data", " - reduce dependencies to the needed minimum", "" ], "package": "distro-info-data", "version": "2026.10.12-0ubuntu0.22.04.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2170573 ], "author": "Benjamin Drung ", "date": "Mon, 12 Oct 2026 17:36:37 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libapt-pkg6.0:riscv64", "from_version": { "source_package_name": "apt", "source_package_version": "2.4.14", "version": "2.4.14" }, "to_version": { "source_package_name": "apt", "source_package_version": "2.4.15ubuntu0.1", "version": "2.4.15ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Download verification bypass", " - methods/*.cc: Open target files exclusively", " - CVE-2026-109518", " * SECURITY UPDATE: Out-of-bounds accesses", " - deb: guard against unsigned underflow when trimming control newlines", " - gpgv: don't advance past the null terminator in PushEntryWithKeyID", " - debDebFileParser: reject .deb without a Version field", " - srvrec: reject res_query answers bigger than our buffer", " - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check", " * Test suite reliability:", " - test: Limit valgrind to 1024 open files", "" ], "package": "apt", "version": "2.4.15ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 02 Nov 2026 13:56:44 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbrotli1:riscv64", "from_version": { "source_package_name": "brotli", "source_package_version": "1.0.9-2build6", "version": "1.0.9-2build6" }, "to_version": { "source_package_name": "brotli", "source_package_version": "1.0.9-2ubuntu0.1", "version": "1.0.9-2ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "high", "cve_public_date": "2026-10-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "high", "cve_public_date": "2026-10-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: DoS or code exec via buffer overflow", " - debian/patches/CVE-2026-111497.patch: Detect and report invalid stream", " earlier. in c/dec/decode.c, c/include/brotli/decode.h.", " - CVE-2026-111497", "" ], "package": "brotli", "version": "1.0.9-2ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Sun, 25 Oct 2026 13:50:48 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-0:riscv64", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.10", "version": "2.72.4-0ubuntu2.10" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.11", "version": "2.72.4-0ubuntu2.11" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.72.4-0ubuntu2.11", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 16:21:29 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-bin", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.10", "version": "2.72.4-0ubuntu2.10" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.11", "version": "2.72.4-0ubuntu2.11" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.72.4-0ubuntu2.11", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 16:21:29 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-data", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.10", "version": "2.72.4-0ubuntu2.10" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.11", "version": "2.72.4-0ubuntu2.11" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.72.4-0ubuntu2.11", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 16:21:29 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblzma5:riscv64", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.1", "version": "5.2.5-2ubuntu1.1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.2", "version": "5.2.5-2ubuntu1.2" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.2.5-2ubuntu1.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:08 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnss3:riscv64", "from_version": { "source_package_name": "nss", "source_package_version": "2:3.98-0ubuntu0.22.04.4", "version": "2:3.98-0ubuntu0.22.04.4" }, "to_version": { "source_package_name": "nss", "source_package_version": "2:3.98-0ubuntu0.22.04.5", "version": "2:3.98-0ubuntu0.22.04.5" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * d/p/certdata-remove-compromised-certs.patch: remove the following", " CA certs from ckfw/builtins/certdata due to intermediate cert", " compromise", " + \"emSign ECC Root CA - G3\"", " + \"Comodo AAA Services root\"", "" ], "package": "nss", "version": "2:3.98-0ubuntu0.22.04.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Elise Hlady ", "date": "Tue, 20 Oct 2026 16:15:32 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpcre2-8-0:riscv64", "from_version": { "source_package_name": "pcre2", "source_package_version": "10.39-3ubuntu0.1", "version": "10.39-3ubuntu0.1" }, "to_version": { "source_package_name": "pcre2", "source_package_version": "10.39-3ubuntu0.2", "version": "10.39-3ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-103111", "url": "https://ubuntu.com/security/CVE-2026-103111", "cve_description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "cve_priority": "medium", "cve_public_date": "2026-09-30 05:16:00 UTC" }, { "cve": "CVE-2026-86145", "url": "https://ubuntu.com/security/CVE-2026-86145", "cve_description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "cve_priority": "medium", "cve_public_date": "2026-09-05 06:17:00 UTC" }, { "cve": "CVE-2026-89156", "url": "https://ubuntu.com/security/CVE-2026-89156", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89157", "url": "https://ubuntu.com/security/CVE-2026-89157", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89158", "url": "https://ubuntu.com/security/CVE-2026-89158", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89160", "url": "https://ubuntu.com/security/CVE-2026-89160", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89161", "url": "https://ubuntu.com/security/CVE-2026-89161", "cve_description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-103111", "url": "https://ubuntu.com/security/CVE-2026-103111", "cve_description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "cve_priority": "medium", "cve_public_date": "2026-09-30 05:16:00 UTC" }, { "cve": "CVE-2026-86145", "url": "https://ubuntu.com/security/CVE-2026-86145", "cve_description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "cve_priority": "medium", "cve_public_date": "2026-09-05 06:17:00 UTC" }, { "cve": "CVE-2026-89156", "url": "https://ubuntu.com/security/CVE-2026-89156", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89157", "url": "https://ubuntu.com/security/CVE-2026-89157", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89158", "url": "https://ubuntu.com/security/CVE-2026-89158", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89160", "url": "https://ubuntu.com/security/CVE-2026-89160", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89161", "url": "https://ubuntu.com/security/CVE-2026-89161", "cve_description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Fix large JIT stack allocation.", " - src/pcre2_jit_compile.c: Track oversized stack allocations and compute", " the growth threshold from the stack top instead of assuming the stack", " starts near its base, preventing an out-of-bounds write.", " - Authors: Zoltan Herczeg, Nicholas Wilson", " - 2b4038298072684b0fae29b15bedfb1a75bda46d", " - 6f9d7c1373262c541324a16a358785b33ef116cf", " - CVE-2026-103111", " * SECURITY UPDATE: Fix DFA workspace overflows", " - src/pcre2_dfa_match.c: Size new workspace blocks to fit the current", " ovector request and stop reusing a next block that is too small,", " preventing workspace overflow past the heap limit.", " - testdata/testinput6, testdata/testoutput6: Regression tests for the", " workspace overflow cases.", " - Author: Nicholas Wilson", " - c932e70451eafef922ebef364ac25042f0031135", " - CVE-2026-86145", " * SECURITY UPDATE: Fix pcre2_match to check for JIT support before JIT", " validation & execution", " - src/pcre2_internal.h: Declare the new jit_check_exec() helper.", " - src/pcre2_jit_misc.c: Add jit_check_exec() to verify the requested", " matching mode is compiled in before running JIT code.", " - src/pcre2_match.c: Gate the JIT fast path on jit_check_exec() so a", " missing JIT mode falls through to the interpreter's own UTF validation", " instead of skipping it.", " - Author: Zoltan Herczeg", " - f67db227af31bba7cdf2a7a00b97af91b588c2f5", " - CVE-2026-89156", " * SECURITY UPDATE: Use CU2BYTES for byte sizing in two allocation sites", " - src/pcre2_convert.c, src/pcre2_substring.c: Size allocations with", " CU2BYTES() instead of multiplying by PCRE2_CODE_UNIT_WIDTH, and reject", " lengths that would overflow the size calculation.", " - Author: Ilia Alshanetsky", " - 8156b3989a82f2ddf9504d8248496e9b124be7f3", " - CVE-2026-89157", " * SECURITY UPDATE: Fix compiler integer overflows", " - src/pcre2_compile.c: Guard pattern length accumulation against", " OFLOW_MAX and MAX_PATTERN_SIZE overflow.", " - Author: Nicholas Wilson", " - ec9c286d5c10cf1c388b58a442ccefded42254fd", " - CVE-2026-89158", " * SECURITY UPDATE: Fix invalid UTF backwards-scan reads", " - src/pcre2_extuni.c, src/pcre2_match.c: Bound backwards scans at", " check_subject rather than start_subject so they cannot read into an", " invalid UTF prefix before it has been validated.", " - testdata/testinput10, testdata/testoutput10, testdata/testinput12,", " testdata/testoutput12-16, testdata/testoutput12-32: Regression tests", " for backwards scans over invalid UTF prefixes.", " - Author: Nicholas Wilson", " - 4889caf31a4c5a6b3c051f0031bf2dbd78f2c287", " - CVE-2026-89160", " * SECURITY UPDATE: Fix leak & stale PCRE2_MD_COPIED_SUBJECT if", " pcre2_jit_match used with existing match context.", " - src/pcre2_jit_match.c: Free a previously copied subject and clear the", " PCRE2_MD_COPIED_SUBJECT flag before reusing a match data block.", " - src/pcre2test.c: Detect a wrongly-set or wrongly-cleared copied-subject", " state after a JIT match.", " - testdata/testinput17, testdata/testoutput17: Test the copied-subject", " handling on the JIT fast path.", " - Author: Nicholas Wilson", " - 1dcd0cf42a6a7cb62cc9a7c024196733abcfda95", " - CVE-2026-89161", "" ], "package": "pcre2", "version": "10.39-3ubuntu0.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 15 Oct 2026 17:22:01 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "nano", "from_version": { "source_package_name": "nano", "source_package_version": "6.2-1ubuntu0.2", "version": "6.2-1ubuntu0.2" }, "to_version": { "source_package_name": "nano", "source_package_version": "6.2-1ubuntu0.3", "version": "6.2-1ubuntu0.3" }, "cves": [], "launchpad_bugs_fixed": [ 1998592 ], "changes": [ { "cves": [], "log": [ "", " * Fix Enter eating non-blank characters with -i -b (LP: #1998592).", " - debian/patches/fix-enter-eating-nonblanks.patch: Check that the", " preceding characters are actually whitespace before setting", " allblanks in do_enter() in src/text.c.", "" ], "package": "nano", "version": "6.2-1ubuntu0.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1998592 ], "author": "Varun Varma ", "date": "Mon, 13 Jul 2026 14:45:28 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-twisted", "from_version": { "source_package_name": "twisted", "source_package_version": "22.1.0-2ubuntu2.7", "version": "22.1.0-2ubuntu2.7" }, "to_version": { "source_package_name": "twisted", "source_package_version": "22.1.0-2ubuntu2.8", "version": "22.1.0-2ubuntu2.8" }, "cves": [ { "cve": "CVE-2026-106454", "url": "https://ubuntu.com/security/CVE-2026-106454", "cve_description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.", "cve_priority": "medium", "cve_public_date": "2026-10-06 20:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106454", "url": "https://ubuntu.com/security/CVE-2026-106454", "cve_description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.", "cve_priority": "medium", "cve_public_date": "2026-10-06 20:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: DoS in wildcardToRegexp()", " - debian/patches/CVE-2026-106454-1.patch: add a type annotation since we're", " about to make changes in src/twisted/mail/imap4.py.", " - debian/patches/CVE-2026-106454-2.patch: make it pass by escaping", " everything else in src/twisted/mail/imap4.py.", " - debian/patches/CVE-2026-106454-3.patch: failing test that uses a python", " regexp in src/twisted/mail/test/test_imap.py.", " - debian/patches/CVE-2026-106454-4.patch: add more potential matches to", " exclude to be sure in src/twisted/mail/test/test_imap.py.", " - debian/patches/CVE-2026-106454-5.patch: per code review test some more", " cases in src/twisted/mail/test/test_imap.py.", " - debian/patches/CVE-2026-106454-6.patch: per code review, docstring for", " wildcardToRegexp in src/twisted/mail/imap4.py.", " - CVE-2026-106454", "" ], "package": "twisted", "version": "22.1.0-2ubuntu2.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 15 Oct 2026 13:02:05 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu22.04.1", "version": "2.76.3+ubuntu22.04.1" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.77.1+ubuntu22.04.1", "version": "2.77.1+ubuntu22.04.1" }, "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" }, { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158102, 2072331, 2110510, 2143934, 2160691, 2161982, 2158301, 2159940, 2157692, 2067006, 2157692, 2067006, 2154498, 2147606, 2148544, 2139213, 2125344, 2150683, 2152908, 1966067, 2110368, 2110368, 2144666, 2146337, 2147207, 2143882 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2158102", " - Fix undo of unlink-component after its snap revision was discarded", " - interfaces: power-control | allow reading all battery state files", "" ], "package": "snapd", "version": "2.77.1+ubuntu22.04.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2158102 ], "author": "Ernest Lotter ", "date": "Wed, 02 Sep 2026 14:39:12 +0200" }, { "cves": [], "log": [ "", " - Account for differences in names of the binaries in the snapd FIPS", " build", " - Add code to calculate canonical subject name hash", " - Add commands for debugging or accessing snap mount namespaces", " - Add helpers for listing and iterating device mediation groups", " - Add package ebpf with helpers wrapping eBPF exposed objects with", " dependency on github.com/cilium/ebpf", " - Add secondary prerequisites task that acts as the synchronization", " point, which ensures that a snap's prerequisites are available", " before it's installed", " - Add support for shell conditional syntax in envs", " - Added /usr/share/{man,help,info} to system-packages-doc", " - asserts: add validation-sets confdb-schema builtin", " - asserts: ensure that compatibility labels are strings", " - asserts: extend on-classic constraints to accept \"distro/variant\",", " \"distro/*\", and \"distro/\" under a new snap-declaration format 7", " - asserts: validate serial in newDeviceIDFromString", " - Bump github.com/canonical/go-efilib to v1.8.0 to include fixes for", " efivars probe", " - confdb: add validation-sets handler and fix data loss when writing", " to new schemas or accounts", " - confdb: fix bug on reading uneven lists", " - confdb: literal subkeys are sorted after placeholders", " - confdb: run observe-view-* hooks after commit", " - confdb: support Encode/Decode for builtins", " - confdb: support sign-only external keypair backends", " - core-initrd: add missing libbpf and systemd dlopen dependencies,", " and increase mount burst", " - Drop task logs for delayed effects", " - During snap removal, clear-snap task errors early if there are", " user mounts in snap data dirs", " - Enable reverts to trigger a seed refresh", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", " - Ensure that prereqs created by initial refresh run before create-", " recovery-system", " - Exclude Georgian from translation linting", " - experimental features: graduate layouts, classic-preserves-xdg-", " runtime-dir, refresh-app-awareness, and dbus-activation features", " - experimental features: warn when setting graduated or default-", " enabled experimental features and do not store settings for", " graduated features", " - Expose individual certs as well as c_rehash emulation", " - Extend autogen with explicit --sysconfdir", " - External keypair manager: add shared external key manager", " implementation", " - External keypair manager: refactor GPG and external keypair", " managers to use extKeypairMgrImpl", " - External keypair manager: support external OPENPGP signing in", " ExternalKeypairManager", " - FDE: add post install actions API", " - FDE: add reprovision API", " - FDE: add reprovision recovery key generation API", " - FDE: add reseal check after snapd refresh", " - FDE: allow reprovision without factory reset", " - FDE: change makebootable part of the boot package to not take", " install observers as parameters", " - FDE: extend storage-encrypted system information", " - FDE: make reprovision only seal", " - FDE: remove all tmp keyslots on error", " - FDE: remove check for unchanged authentication options", " - FDE: run post install checks during auto repair", " - Filter seed-refresh based on model and seed presence", " - Fix failing snap remove when there are snapctl created mounts", " under snap global data dirs", " - Fix postNotices to validate before locking state", " - Guard the ensure check from running on classic", " - Implement remodeling fully in terms of updates", " - Implement ShutDown for HookManager", " - Include variables SNAP_APP_NAME, and when applicable", " SNAP_APP_COMMON_ID, SNAP_APP_DESKTOP_FILE and SNAP_APP_BUS_NAME in", " snap application environments", " - interfaces: add xdg-portal-permission-store interface", " - interfaces: allow gtk css in subdirectories", " - interfaces: allow systemd networkd link property changes via D-Bus", " - interfaces: allow the systemd networkctl command", " - interfaces: allow Wine to execute files accessed via the Document", " Portal", " - interfaces: apparmor-observe | add interface", " - interfaces: attempt to fix content with parallel installs", " - interfaces: devlxd | fix access for LXD containers", " - interfaces: docker | allow connecting to system-wide docker on", " classic", " - interfaces: grant default access to memory.high in a snap's cgroup", " - interfaces: iscsi-initiator | allow access to /var/lib/iscsi/nodes", " - interfaces: kernel-sched-ext-control | add the kernel sched-ext", " control interface implementation", " - interfaces: make polkit and upower implicit on Core systems only", " - interfaces: open-iscsi | add missing state paths", " - interfaces: opengl | expose wsl libraries", " - interfaces: u2f-devices | add atkey PID and relative VID support", " - List dir contents on failure to remove snap base data dir", " - List non-snapctl mounts in snap data dirs", " - LP: #2072331 Validate map keys in JSON config values", " - LP: #2110510 Interfaces: allow reading of /proc/self/smaps_rollup", " - LP: #2143934 Interfaces: network-control, network-manager | allow", " missing resolve1 link setters", " - LP: #2160691 Security logging: strip trailing whitespace from", " audit netlink message payload", " - LP: #2161982 Interfaces: vsock | add interface for VM guest", " services", " - Make arguments of debug mount-namespace consistent with other", " debug commands", " - Make bootloader logging less verbose", " - Make cert manager garbage check run after symlink migration", " - Make secondary prerequisite synchronization task handle same-", " change retries", " - mkversion.sh: do describe in worktrees too", " - multi-entry snapd: merge snap and snapd binaries", " - multi-entry snapd: move debug device-cgroup implementation file", " under cmd/snapd/cli", " - multi-entry snapd: move snap-gpio-helper sources around before", " transitioning to multi-entry dispatch", " - multi-entry snapd: move snapd-apparmor sources to a dedicated tool", " location", " - multi-entry snapd: move source files around in preparation for", " snapd/snap merge", " - multi-entry snapd: move the snap-preseed sources around in", " preparation", " - multi-entry snapd: move the sources of snapctl and snap-exec in", " preparation for the multi-entry dispatch", " - Never create seed refresh tasks during a remodel", " - packaging: assign a default label for /tmp/snap-private-tmp and", " set it during installation", " - packaging: build deb with Go 1.23 for noble and jammy, Go 1.22 for", " focal", " - packaging: drop SNAP_TAGS", " - packaging: drop symlinks for opensuse 15.5/15.6 packaging", " - packaging: fix service startup during install and session-agent", " socket handling on Ubuntu 26.04+", " - packaging: fix stderr redirection", " - packaging: restore gbp.conf output directory for Ubuntu 26.04", " builds", " - packaging: switch to apparmor 5.x with 5 ABI", " - packaging: update bundled AppArmor to 5.0.2 and accept the 5.0 ABI", " when running as deb", " - packaging: use a relative symlink for snapctl and update steam-", " support udev rules", " - Preserve component in hook security tags", " - Prevent removal of seed-refresh snaps when seed-refresh is enabled", " - Refactor base-declaration into 1st class builtin assertion", " - Refactor how the is-originating-from-snap-command advisory check", " works", " - Refactor prerequisites task handler to enable proper seed-refresh", " integration", " - Reintroduce fdstore helpers", " - remote device management: add task to validate request messages", " - remote device management: apply management messages, queue", " response messages, and improve sequencing and redelivery handling", " - Remove osutil unused AtomicWriteFollow flag", " - Remove xerrors dependency", " - Reuse existing seed-refresh implementation for free during single-", " path installation", " - Rework how SnapSetup.SnapPath is used", " - seccomp: allow rseq_slice_yield", " - security logging: add seclog API for administrative actions and", " token create/remove events", " - security logging: add security logging for adding, updating and", " removing a snapd user", " - Set target hostname from install-mode", " - snap-confine: improve loading of BPF programs, retry on failures", " to collect verifier logs", " - snap-confine: use profile and flags= in snap-confine and snap-", " update-ns' AppArmor profiles", " - snap-confine: work around kernel mnt_ns_loop() ordering bug on", " 6.18.x", " - snap: add debug command for listing currently mediated devices for", " a given snap", " - snap: fix self-managed cgroup support checks", " - snap: report hidden file access for paths allowed by home when", " prompting is active", " - snap: report read-only file access for paths allowed by system-", " package-doc", " - snapctl async support: add --format json to snap tasks to be", " consistent with snapctl", " - snapctl async support: add snapctl tasks command", " - snapctl async support: async feature negotiation between snap", " client and daemon", " - snapctl async support: fix snapctl is-ready exit codes", " - snapctl async support: re-enable snapctl async functionality", " - snapshots: restore preserves snapctl created mounts", " - snapshots: save excludes all mount points", " - Support ca-certificate.crt only systems like core26", " - Turn on quota-groups by default", " - Use 0755 for certificate generation directories", " - Use CreateTemp for NewAtomicFile tmp file creation", " - Verify cached downloads in the do path and detect obvious", " corruption", "" ], "package": "snapd", "version": "2.77+ubuntu22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2072331, 2110510, 2143934, 2160691, 2161982 ], "author": "Sergio Cazzolato ", "date": "Fri, 24 Jul 2026 20:45:05 -0300" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2158301", " - FDE: support keyboard configuration at install-time for first-boot", " - FDE: re-enable passphrases/PINs at install-time", " - FDE: require volumes authentication if HWROT is missing", " - FDE: bump secboot to rev 457b03a16d19", " - FDE: use new secboot API for reprovision TPM", " - Cross-distro: modify SELinux policy to use", " init_named_socket_activation() for allowing systemd to start snapd", " through socket activation", " - packaging: make sure that usr/bin/snap is built with correct build", " tags on debian sid", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", "" ], "package": "snapd", "version": "2.76.3", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2158301 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 10:06:48 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2159940", " - interfaces: steam-support, docker-support | fix mountinfo denial", "" ], "package": "snapd", "version": "2.76.2", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2159940 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 08:38:51 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", "" ], "package": "snapd", "version": "2.76.1", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Thu, 25 Jun 2026 13:09:05 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", " - SNAPDENG-36017", "" ], "package": "snapd", "version": "2.76.1", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Sat, 20 Jun 2026 10:27:54 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2154498", " - assertions: add helper for validating integrity data", " - assertions: drop incorrect/non-standard Ed25519 support", " - confdb: allow only API admin read access to confdb secrets", " - confdb: block concurrent confdb accesses", " - confdb: block concurrent snapctl accesses to configuration", " database", " - confdb: check for ephemeral data when missing save-view hook on", " commit", " - confdb: ignore not-found errors in confdb-schema refreshes", " - confdb: support --wait-for timeouts when accessing confdb", " - core-initrd: add group referenced in udev rules", " - core-initrd: add libbpf dependency to initramfs", " - core-initrd: add missing libbpf dependency in 24.04 packaging", " - core-initrd: ensure audio is a system group", " - core-initrd: fix /boot/uboot mount with u-boot env in dedicated", " partition", " - core-initrd: increase mount burst from 5 to 128 for faster boot", " - core-initrd: sync partition udev rules with the ones in core-base", " - core-initrd: sync with latest upload to snappy-dev PPA", " - core-initrd: synchronize changelogs with latest PPA upload", " - core-initrd: update changelog with latest PPA upload", " - core-initrd: add nfnetlink module to fix nf netlink", " socket speed regression (Ubuntu Core only)", " - cross-distro: allow snapd to manipulate systemd unit files in", " SELinux policy", " - cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch", " - desktop: fix common ID selection with multiple desktop plugs", " - FDE: allow user mode on core in secboot TPM handling", " - FDE: bump go-efilib dependency", " - FDE: bump secboot to rev cdcb64992e54 for FDE fixes", " - FDE: deprecate check-pin/passphrase API endpoints", " - LP: #2147606 FDE: give inactive state on classic", " - FDE: improve tracing for OP-TEE probing", " - FDE: move auto-repair logic to overlord/fdestate and provide state", " - FDE: update secboot for TPM/FDE bug fixes including Intel HAP and", " recovery key parsing", " - FDE: use any primary key matching digest when adding a keyslot", " - FDE: use ignore action for preinstall check in VM", " - interfaces: bluez | drop explicit deny send_destination in D-Bus", " configuration", " - interfaces: conditionally deny /proc/self/mountinfo to suppress Go", " 1.25+ denials", " - interfaces: custom-device | fix for-device validation panic on", " non-string value", " - interfaces: disallow auto-connect to parallel installs", " - interfaces: docker | make plug implicit on classic systems", " - interfaces: ignore errors in disconnect hooks during explicit snap", " disconnect", " - interfaces: mediatek-accel | add plug interface base declaration", " - interfaces: microceph-support | suppress noisy sudo denial audit", " logs", " - interfaces: podman | add new interface for podman socket access", " - interfaces: pulseaudio | fix security tag syntax inconsistency", " - interfaces: raw-usb | allow USB device enumeration on Fairphone 5", " with NexDock", " - interfaces: restore auto-connections on failed refresh undo", " - LP: #2148544 interfaces: bool-file | support deep SoC sysfs paths", " for LED brightness", " - LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17", " compliant", " - packaging: add cross-distro build script and instructions", " - packaging: add openSUSE 16.0 spread support", " - packaging: Debian build improvements", " - packaging: default openSUSE to /var/lib/snapd/snap and sync from", " downstream", " - packaging: drop transitional packages only for Ubuntu 26.04", " (Resolute)", " - packaging: fix Launchpad FIPS build detection for snapd-fips job", " - packaging: refactor and clean up snapd.mk, standardize test-data", " directories", " - packaging: switch to golang-github-chai2010-gettext-go-dev", " - packaging: update bundled AppArmor 4.1.7 (snapd snap only)", " - prompting: escape paths in prompt constraints", " - prompting: improve API error handling and validation", " - prompting: improve error message when no handler service is", " present", " - prompting: re-enable the prompting notice backend", " - prompting: respond with full user-allowed permission set", " - prompting: validate permissions while unmarshalling", " - remote device management: implement dispatch-mgmt-messages task", " with sequencing support", " - LP: #2125344 snap: avoid empty channel forwarding message", " - LP: #2150683 snap: clarify snap install help text for --classic", " and --devmode", " - LP: #2152908 snap: print complex attributes in snap interface", " --attrs output", " - snap: add run-inhibit hint and inhibit info when a snap is", " disabled", " - snap: allow removing a snap and its base at the same time", " - snap: display detailed component information in snap info", " - snap: extend AlreadyInstalledError to multiple snaps and", " components", " - snap: extend set-quota command options description with accepted", " value formats", " - snap: implement snap delta command for computing snap deltas", " - snap: improve consistency for snap install when some snaps are", " already installed", " - snap: show hint in snap list that a snap has components", " - snap-confine: allow inheriting unix sockets from snaps", " - snap-confine: allow linking to libm in AppArmor profile", " - snap-confine: fix out-of-bounds read in mountinfo parser for", " partial escape sequences", " - snap-confine: harden bpffs mount with nosuid, nodev, noexec flags", " - snap-confine: remove experimental persistent per-user mount", " namespace feature", " - snap-confine: set FD_CLOEXEC on file descriptors returned by BPF", " helpers", " - snap-confine: support transparent_hugepage in AppArmor profile", " - snap-confine: use strchr after NUL-terminating in infofile parser", " - snap-update-ns: switch to a multi-pass process for constructing", " and updating mount namespaces", " - RemoveMountUnitFile now unmounts even if mount unit file is", " missing", " - Add explicit mount phase during single-reboot refresh to fix undo", " of kernel refreshes", " - Add security audit logging subsystem", " - Add base prioritized AppArmmor snippets for strictly confined or", " jailed snaps", " - Allow openshell snap to use experimental daemon-scope: user", " - Allow configuring mount unit options based on filesystem type", " - Allow equals signs in uevent values in netlink parser", " - Also bind-mount directories modified by kmod backend during", " preseed", " - Clean up potentially corrupted files during snap download undo", " - Complete the bootloader environment implementation", " - Copy integrity data files during snap install", " - Create hook for seed refresh mode", " - Create removal tasks for old seed-refresh seeds", " - Dispatch systemctl commands asynchronously when calling Stop()", " - Ensure /tmp/.X11-unix created inside mount namespace has correct", " permissions", " - Ensure exclusive changes conflict with refresh/revert", " - Ensure existing snap confinement flags are not dropped when", " installing or removing components", " - Export ubuntu-boot-state filename constant from bootloader package", " - Fix duplicate removal of apps under $SNAP_MOUNT_DIR/bin", " - Fix integration between prerequisites task and seed-refresh mode", " - Fix split-refresh overwriting provided lane", " - Fix use of umask in GetListener for socket activation", " - Ignore net.ErrClosed during daemon shutdown", " - Implement ResolveValidationSetsEnforcementError in terms of one", " call", " - Improve snapctl install consistency when components are already", " installed", " - Inject seed creation tasks into snap refresh flow", " - Introduce system options for custom certificates on Ubuntu Core", " - Keep idle services with activation units stopped on reload", " - List snap components in snap-debug-info via debug-tools", " - Look at gadget.yaml instead of marker file to determine ubootpart", " usage", " - LP: #1966067 Skip redundant xdg-settings confirmation prompt when", " setting is already correct", " - LP: #2110368 Fix component installation for private snaps via", " snapctl", " - LP: #2110368 Fix download of private snap components by setting", " UserID", " - LP: #2144666 Fix mount namespace updates with synthetic bind", " mounts on same target paths", " - LP: #2146337 Improve handling of failed downloads and retain", " partial files for resume", " - LP: #2147207 Fix snap enable/disable cycle forgetting components", " - Make run-inhibit hint for kill-snap-apps task based on kill reason", " - Merge content-provider prerequisite updates into seed-refresh", " - Move SortServices into Backend.StartServices", " - Move state to client change conversion to ctlcmd package", " - Omit misleading \"try to refresh snapd\" suggestion for ISA-related", " errors", " - Only create link-component tasks when needed during refresh to", " existing revision", " - Reconfigure piboot bootloader on gadget refreshes to preserve", " os_prefix", " - Reduce the number of AppArmor profile regenerations during snap", " operations", " - Refactor seed-refresh ownership to devicestate", " - Regenerate certificate database on remodels", " - Remove obsolete FIXME comment in VersionCompare", " - Remove unused GenerateDmVerityData helper from snap/integrity", " - Rename and document error type for ISA assumes flags", " - Restart snapd from daemon.Stop to improve restart reliability", " - Restart stopped services on error in stopSnapServices for", " transactionality", " - Simplify certificate-db updates on model-base refresh/installs", " - Support racing Loop and Stop correctly in overlord", " - Support sending file descriptors to systemd via sd_notify", " - Unroll CPU-heavy recursive function in snap state handlers", " - Update seccomp syscalls list for kernel 7.1.0", " - Use change ID to prevent nested seed-refresh spawned by", " prerequisites", " - Validate content interface plug target directories exist for", " core26+ snaps", " - Validate layout paths exist in snap tree for snaps using bare or", " core26+", "" ], "package": "snapd", "version": "2.76", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2154498, 2147606, 2148544, 2139213, 2125344, 2150683, 2152908, 1966067, 2110368, 2110368, 2144666, 2146337, 2147207 ], "author": "Ernest Lotter ", "date": "Thu, 28 May 2026 20:00:16 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2143882", " - Interfaces: network-setup-*| allow running python binaries from", " the base on UC26+", " - Cross-distro: modify SELinux policy to allow mounting on", " /var/snap//", " - Fix potential task deadlock by considering all tasks in a lane", " that might be waiting for a reboot when processing delayed", " security backend effects", "" ], "package": "snapd", "version": "2.75.2", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2143882 ], "author": "Katie May ", "date": "Mon, 30 Mar 2026 17:06:36 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "tmux", "from_version": { "source_package_name": "tmux", "source_package_version": "3.2a-4ubuntu0.2", "version": "3.2a-4ubuntu0.2" }, "to_version": { "source_package_name": "tmux", "source_package_version": "3.2a-4ubuntu0.3", "version": "3.2a-4ubuntu0.3" }, "cves": [], "launchpad_bugs_fixed": [ 2169164 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2169164-uninitialized-notify.patch: Don't notify clients if not", " fully initialized (LP: #2169164)", "" ], "package": "tmux", "version": "3.2a-4ubuntu0.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2169164 ], "author": "Grayson Wolf ", "date": "Mon, 05 Oct 2026 15:45:28 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-advantage-tools", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04.1", "version": "37.2ubuntu~22.04.1" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "38ubuntu0~22.04", "version": "38ubuntu0~22.04" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2131292, 2129712 ], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:36:19 +0200" }, { "cves": [], "log": [ "", " * d/apparmor/ubuntu_pro_esm_cache.jinja2: fix \"DENIED\" messages when", " devicetree exists (LP: #2131292)", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2131292 ], "author": "Renan Rodrigo ", "date": "Tue, 07 Apr 2026 15:24:25 -0300" }, { "cves": [], "log": [ "", " * Backport 37.1ubuntu0 to jammy (LP: #2129712)", "" ], "package": "ubuntu-advantage-tools", "version": "37.1ubuntu0~22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2129712 ], "author": "Renan Rodrigo ", "date": "Mon, 27 Oct 2025 09:42:11 -0300" } ], "notes": null, "is_version_downgrade": true }, { "name": "ubuntu-pro-client", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04.1", "version": "37.2ubuntu~22.04.1" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "38ubuntu0~22.04", "version": "38ubuntu0~22.04" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2131292, 2129712 ], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:36:19 +0200" }, { "cves": [], "log": [ "", " * d/apparmor/ubuntu_pro_esm_cache.jinja2: fix \"DENIED\" messages when", " devicetree exists (LP: #2131292)", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2131292 ], "author": "Renan Rodrigo ", "date": "Tue, 07 Apr 2026 15:24:25 -0300" }, { "cves": [], "log": [ "", " * Backport 37.1ubuntu0 to jammy (LP: #2129712)", "" ], "package": "ubuntu-advantage-tools", "version": "37.1ubuntu0~22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2129712 ], "author": "Renan Rodrigo ", "date": "Mon, 27 Oct 2025 09:42:11 -0300" } ], "notes": null, "is_version_downgrade": true }, { "name": "ubuntu-pro-client-l10n", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04.1", "version": "37.2ubuntu~22.04.1" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "38ubuntu0~22.04", "version": "38ubuntu0~22.04" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2131292, 2129712 ], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:36:19 +0200" }, { "cves": [], "log": [ "", " * d/apparmor/ubuntu_pro_esm_cache.jinja2: fix \"DENIED\" messages when", " devicetree exists (LP: #2131292)", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2131292 ], "author": "Renan Rodrigo ", "date": "Tue, 07 Apr 2026 15:24:25 -0300" }, { "cves": [], "log": [ "", " * Backport 37.1ubuntu0 to jammy (LP: #2129712)", "" ], "package": "ubuntu-advantage-tools", "version": "37.1ubuntu0~22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2129712 ], "author": "Renan Rodrigo ", "date": "Mon, 27 Oct 2025 09:42:11 -0300" } ], "notes": null, "is_version_downgrade": true }, { "name": "xfsprogs", "from_version": { "source_package_name": "xfsprogs", "source_package_version": "5.13.0-1ubuntu2.1", "version": "5.13.0-1ubuntu2.1" }, "to_version": { "source_package_name": "xfsprogs", "source_package_version": "5.13.0-1ubuntu2.2", "version": "5.13.0-1ubuntu2.2" }, "cves": [], "launchpad_bugs_fixed": [ 2101888 ], "changes": [ { "cves": [], "log": [ "", " * Prevent fsck.xfs from dropping into emergency mode when a forced repair", " encounters a dirty XFS journal (LP: #2101888).", " - d/p/lp2101888-replay-log-before-xfs-repair.patch: Mount and unmount the", " filesystem to replay its journal, then rerun xfs_repair.", "" ], "package": "xfsprogs", "version": "5.13.0-1ubuntu2.2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2101888 ], "author": "Seyeong Kim ", "date": "Mon, 14 Sep 2026 10:47:17 +0900" } ], "notes": null, "is_version_downgrade": false }, { "name": "xz-utils", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.1", "version": "5.2.5-2ubuntu1.1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.2.5-2ubuntu1.2", "version": "5.2.5-2ubuntu1.2" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.2.5-2ubuntu1.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:08 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [ { "name": "core22", "from_version": { "source_package_name": null, "source_package_version": null, "version": "2959" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "2992" } }, { "name": "lxd", "from_version": { "source_package_name": null, "source_package_version": null, "version": "40930" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "41291" } } ] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20261020 to 20261106", "from_series": "jammy", "to_series": "jammy", "from_serial": "20261020", "to_serial": "20261106", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }