{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "distro-info", "libc-bin", "libc6", "libperl5.34", "perl", "perl-base", "perl-modules-5.34", "python3-distro-info", "snapd" ] } }, "diff": { "deb": [ { "name": "distro-info", "from_version": { "source_package_name": "distro-info", "source_package_version": "1.1ubuntu0.2", "version": "1.1ubuntu0.2" }, "to_version": { "source_package_name": "distro-info", "source_package_version": "1.1ubuntu0.3", "version": "1.1ubuntu0.3" }, "cves": [], "launchpad_bugs_fixed": [ 1012459, 2131678 ], "changes": [ { "cves": [], "log": [ "", " * Perl library:", " - fix exporting convert_date", " - add get_all_series() function (Closes: #1141228, LP: #1012459)", " * Support Ubuntu Pro with Legacy add-on (LP: #2131678):", " - ubuntu-distro-info: add --supported-legacy", " - python: add UbuntuDistroInfo.supported_legacy", " - perl: add UbuntuDistroInfo.supported_legacy", " * Add autopkgtest for testing libdistro-info-perl", " * Add test cases for ubuntu-distro-info --supported-esm", " * Makefile: remove python/.mypy_cache on clean", "" ], "package": "distro-info", "version": "1.1ubuntu0.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1012459, 2131678 ], "author": "Benjamin Drung ", "date": "Wed, 14 Oct 2026 16:42:30 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.15", "version": "2.35-0ubuntu3.15" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.18", "version": "2.35-0ubuntu3.18" }, "cves": [ { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-86805", "url": "https://ubuntu.com/security/CVE-2026-86805", "cve_description": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.", "cve_priority": "medium", "cve_public_date": "2026-09-22 16:18:00 UTC" }, { "cve": "CVE-2026-95818", "url": "https://ubuntu.com/security/CVE-2026-95818", "cve_description": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.", "cve_priority": "medium", "cve_public_date": "2026-09-22 17:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-84243", "url": "https://ubuntu.com/security/CVE-2026-84243", "cve_description": "The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program. That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program. The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.", "cve_priority": "medium", "cve_public_date": "2026-10-30 18:18:00 UTC" } ], "launchpad_bugs_fixed": [ 2170563 ], "changes": [ { "cves": [ { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-86805", "url": "https://ubuntu.com/security/CVE-2026-86805", "cve_description": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.", "cve_priority": "medium", "cve_public_date": "2026-09-22 16:18:00 UTC" }, { "cve": "CVE-2026-95818", "url": "https://ubuntu.com/security/CVE-2026-95818", "cve_description": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.", "cve_priority": "medium", "cve_public_date": "2026-09-22 17:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-84243", "url": "https://ubuntu.com/security/CVE-2026-84243", "cve_description": "The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program. That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program. The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.", "cve_priority": "medium", "cve_public_date": "2026-10-30 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow", " - debian/patches/CVE-2026-18374.patch: libio: Fix heap buffer overflow in", " ccs= handling in libio/fileops.c.", " - CVE-2026-18374", " * SECURITY UPDATE: DoS with long domain name", " - debian/patches/CVE-2026-8674.patch: resolv: Fix assertion failure on", " search list truncation in resolv/resolv_conf.c,", " resolv/tst-resolv-res_init-skeleton.c.", " - CVE-2026-8674", " * SECURITY UPDATE: TOCTOU in dynamic loader", " - debian/patches/CVE-2026-86805_95818-pre1.patch: support: Add", " support_next_to_fault_before support function in support/next_to_fault.c,", " support/next_to_fault.h.", " - debian/patches/CVE-2026-86805_95818-pre2.patch: support: Add envp argument", " to support_capture_subprogram in elf/tst-audit18.c, elf/tst-audit19b.c,", " elf/tst-audit22.c, elf/tst-audit23.c, elf/tst-audit25a.c, elf/tst-", " audit25b.c, elf/tst-glibc-hwcaps-2-cache.c, elf/tst-rtld-run-static.c,", " support/capture_subprocess.h, support/subprocess.h,", " support/support_capture_subprocess.c, support/support_subprocess.c,", " support/tst-support_capture_subprocess.c.", " - debian/patches/CVE-2026-86805_95818.patch: elf: Open the normalized", " $ORIGIN rpath in AT_SECURE programs in elf/Makefile, elf/dl-load.c,", " elf/dl-path-normalize.h, elf/libtst-origin-secure-mod.c, elf/tst-", " dl-path-normalize.c, elf/tst-origin-secure-evilmod.c, elf/tst-origin-", " secure-victim.c, elf/tst-origin-secure.c, elf/tst-origin-secure.h.", " - CVE-2026-86805", " - CVE-2026-95818", " * SECURITY UPDATE: stack overflow in nscd", " - debian/patches/CVE-2026-89092.patch: nscd: replace alloca with malloc", " in aicache, hstcache in nscd/aicache.c, nscd/hstcache.c.", " - CVE-2026-89092", " * SECURITY UPDATE: crash in strncasecmp on power8", " - debian/patches/CVE-2026-97399.patch: powerpc: Fix one byte overread in", " strncasecmp in string/Makefile, string/test-strncasecmp-nonarray.c,", " sysdeps/powerpc/powerpc64/power8/strcasecmp.S.", " - CVE-2026-97399", " * SECURITY UPDATE: arbitrary gettext load location via LANGUAGE var", " - debian/patches/CVE-2026-84243.patch: intl: Restrict path traversal when", " using LANGUAGE env var in intl/Makefile, intl/dcigettext.c,", " intl/tst-gettext-path-traversal.c.", " - CVE-2026-84243", " * Fix s390x QEMU user-mode emulation issue (LP: #2170563)", " - debian/patches/s390x-alignment.patch: set max-page-size on s390x in", " resolv/Makefile.", "" ], "package": "glibc", "version": "2.35-0ubuntu3.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170563 ], "author": "Marc Deslauriers ", "date": "Thu, 05 Nov 2026 12:18:26 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.15", "version": "2.35-0ubuntu3.15" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.18", "version": "2.35-0ubuntu3.18" }, "cves": [ { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-86805", "url": "https://ubuntu.com/security/CVE-2026-86805", "cve_description": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.", "cve_priority": "medium", "cve_public_date": "2026-09-22 16:18:00 UTC" }, { "cve": "CVE-2026-95818", "url": "https://ubuntu.com/security/CVE-2026-95818", "cve_description": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.", "cve_priority": "medium", "cve_public_date": "2026-09-22 17:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-84243", "url": "https://ubuntu.com/security/CVE-2026-84243", "cve_description": "The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program. That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program. The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.", "cve_priority": "medium", "cve_public_date": "2026-10-30 18:18:00 UTC" } ], "launchpad_bugs_fixed": [ 2170563 ], "changes": [ { "cves": [ { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-86805", "url": "https://ubuntu.com/security/CVE-2026-86805", "cve_description": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.", "cve_priority": "medium", "cve_public_date": "2026-09-22 16:18:00 UTC" }, { "cve": "CVE-2026-95818", "url": "https://ubuntu.com/security/CVE-2026-95818", "cve_description": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.", "cve_priority": "medium", "cve_public_date": "2026-09-22 17:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-84243", "url": "https://ubuntu.com/security/CVE-2026-84243", "cve_description": "The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program. That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program. The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.", "cve_priority": "medium", "cve_public_date": "2026-10-30 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow", " - debian/patches/CVE-2026-18374.patch: libio: Fix heap buffer overflow in", " ccs= handling in libio/fileops.c.", " - CVE-2026-18374", " * SECURITY UPDATE: DoS with long domain name", " - debian/patches/CVE-2026-8674.patch: resolv: Fix assertion failure on", " search list truncation in resolv/resolv_conf.c,", " resolv/tst-resolv-res_init-skeleton.c.", " - CVE-2026-8674", " * SECURITY UPDATE: TOCTOU in dynamic loader", " - debian/patches/CVE-2026-86805_95818-pre1.patch: support: Add", " support_next_to_fault_before support function in support/next_to_fault.c,", " support/next_to_fault.h.", " - debian/patches/CVE-2026-86805_95818-pre2.patch: support: Add envp argument", " to support_capture_subprogram in elf/tst-audit18.c, elf/tst-audit19b.c,", " elf/tst-audit22.c, elf/tst-audit23.c, elf/tst-audit25a.c, elf/tst-", " audit25b.c, elf/tst-glibc-hwcaps-2-cache.c, elf/tst-rtld-run-static.c,", " support/capture_subprocess.h, support/subprocess.h,", " support/support_capture_subprocess.c, support/support_subprocess.c,", " support/tst-support_capture_subprocess.c.", " - debian/patches/CVE-2026-86805_95818.patch: elf: Open the normalized", " $ORIGIN rpath in AT_SECURE programs in elf/Makefile, elf/dl-load.c,", " elf/dl-path-normalize.h, elf/libtst-origin-secure-mod.c, elf/tst-", " dl-path-normalize.c, elf/tst-origin-secure-evilmod.c, elf/tst-origin-", " secure-victim.c, elf/tst-origin-secure.c, elf/tst-origin-secure.h.", " - CVE-2026-86805", " - CVE-2026-95818", " * SECURITY UPDATE: stack overflow in nscd", " - debian/patches/CVE-2026-89092.patch: nscd: replace alloca with malloc", " in aicache, hstcache in nscd/aicache.c, nscd/hstcache.c.", " - CVE-2026-89092", " * SECURITY UPDATE: crash in strncasecmp on power8", " - debian/patches/CVE-2026-97399.patch: powerpc: Fix one byte overread in", " strncasecmp in string/Makefile, string/test-strncasecmp-nonarray.c,", " sysdeps/powerpc/powerpc64/power8/strcasecmp.S.", " - CVE-2026-97399", " * SECURITY UPDATE: arbitrary gettext load location via LANGUAGE var", " - debian/patches/CVE-2026-84243.patch: intl: Restrict path traversal when", " using LANGUAGE env var in intl/Makefile, intl/dcigettext.c,", " intl/tst-gettext-path-traversal.c.", " - CVE-2026-84243", " * Fix s390x QEMU user-mode emulation issue (LP: #2170563)", " - debian/patches/s390x-alignment.patch: set max-page-size on s390x in", " resolv/Makefile.", "" ], "package": "glibc", "version": "2.35-0ubuntu3.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170563 ], "author": "Marc Deslauriers ", "date": "Thu, 05 Nov 2026 12:18:26 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.10", "version": "5.34.0-3ubuntu1.10" }, "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Infinite loop leading to denial of service in podlators", " - debian/patches/CVE-2026-82560.patch: Handle pathological margins in", " Pod::Text in cpan/podlators/lib/Pod/Text.pm,", " cpan/podlators/lib/Pod/Text/Color.pm,", " cpan/podlators/lib/Pod/Text/Overstrike.pm,", " cpan/podlators/lib/Pod/Text/Termcap.pm.", " - CVE-2026-82560", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.10", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 05 Nov 2026 12:56:58 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.10", "version": "5.34.0-3ubuntu1.10" }, "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Infinite loop leading to denial of service in podlators", " - debian/patches/CVE-2026-82560.patch: Handle pathological margins in", " Pod::Text in cpan/podlators/lib/Pod/Text.pm,", " cpan/podlators/lib/Pod/Text/Color.pm,", " cpan/podlators/lib/Pod/Text/Overstrike.pm,", " cpan/podlators/lib/Pod/Text/Termcap.pm.", " - CVE-2026-82560", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.10", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 05 Nov 2026 12:56:58 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.10", "version": "5.34.0-3ubuntu1.10" }, "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Infinite loop leading to denial of service in podlators", " - debian/patches/CVE-2026-82560.patch: Handle pathological margins in", " Pod::Text in cpan/podlators/lib/Pod/Text.pm,", " cpan/podlators/lib/Pod/Text/Color.pm,", " cpan/podlators/lib/Pod/Text/Overstrike.pm,", " cpan/podlators/lib/Pod/Text/Termcap.pm.", " - CVE-2026-82560", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.10", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 05 Nov 2026 12:56:58 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.9", "version": "5.34.0-3ubuntu1.9" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.10", "version": "5.34.0-3ubuntu1.10" }, "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-82560", "url": "https://ubuntu.com/security/CVE-2026-82560", "cve_description": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.", "cve_priority": "medium", "cve_public_date": "2026-09-19 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Infinite loop leading to denial of service in podlators", " - debian/patches/CVE-2026-82560.patch: Handle pathological margins in", " Pod::Text in cpan/podlators/lib/Pod/Text.pm,", " cpan/podlators/lib/Pod/Text/Color.pm,", " cpan/podlators/lib/Pod/Text/Overstrike.pm,", " cpan/podlators/lib/Pod/Text/Termcap.pm.", " - CVE-2026-82560", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.10", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 05 Nov 2026 12:56:58 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distro-info", "from_version": { "source_package_name": "distro-info", "source_package_version": "1.1ubuntu0.2", "version": "1.1ubuntu0.2" }, "to_version": { "source_package_name": "distro-info", "source_package_version": "1.1ubuntu0.3", "version": "1.1ubuntu0.3" }, "cves": [], "launchpad_bugs_fixed": [ 1012459, 2131678 ], "changes": [ { "cves": [], "log": [ "", " * Perl library:", " - fix exporting convert_date", " - add get_all_series() function (Closes: #1141228, LP: #1012459)", " * Support Ubuntu Pro with Legacy add-on (LP: #2131678):", " - ubuntu-distro-info: add --supported-legacy", " - python: add UbuntuDistroInfo.supported_legacy", " - perl: add UbuntuDistroInfo.supported_legacy", " * Add autopkgtest for testing libdistro-info-perl", " * Add test cases for ubuntu-distro-info --supported-esm", " * Makefile: remove python/.mypy_cache on clean", "" ], "package": "distro-info", "version": "1.1ubuntu0.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1012459, 2131678 ], "author": "Benjamin Drung ", "date": "Wed, 14 Oct 2026 16:42:30 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.77.1+ubuntu22.04.1", "version": "2.77.1+ubuntu22.04.1" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.78+ubuntu22.04", "version": "2.78+ubuntu22.04" }, "cves": [], "launchpad_bugs_fixed": [ 2166403, 2161845, 2161950, 2164382, 2164689, 2106306, 2082384, 2158102, 2158102, 2072331, 2110510, 2143934, 2160691, 2161982 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2166403", " - FDE: update keyring after reprovision", " - FDE: set new state after reprovision", " - FDE: complete the decision for auto-repair/reprovision", " - FDE: add memfd-secret backed state for secrets", " - FDE: update secboot to rev dd95d85 - support thunderbolt security", " level 0 on UC", " - components: account for components in seed refresh triggering", " - components: prevent components in the seed from being removed", " - components: set $SNAP_COMPONENTS in the application's environment,", " with the path to the snap's own components directory", " - confdb: make error message on map keys for JSON config values more", " specific", " - confdb: support reading/writing to builtin confdbs", " - confdb: enforce validation set constraints before changing state", " - remote device management: update the prepare-serial-request", " registration body to use hardware-id-key-sha3-384 field name", " - packaging: introduce a downstream version suffix to manipulate", " rather than the full version", " - packaging: workaround dh_golang, drop prepare-debian-build-tree", " - security logging: change LogAdminActivity and", " LogUnauthorizedAccess api and structs to specify Who, What and", " Why/-Not", " - interfaces: content | support for sharing content from components", " using the $SNAP_COMPONENT(...) syntax", " - interfaces: shutdown | allow RebootWithFlags", " - interfaces: daemon-notify | allow disconnected path", " /systemd/notify", " - interfaces: microceph-support | add user-identity-switching plug", " attribute", " - interfaces: u2f-devices | add Gemalto eToken Fusion to fallback", " list", " - interfaces: ubuntu-drivers-observe | add new interface", " - interfaces: power-control | allow standardized charge threshold", " sysfs attributes", " - LP: #2161845 interfaces: fix snapd system-key comparison always", " failing", " - LP: #2161950 interfaces: unity7 | allow Chromium", " StatusNotifierItem object paths", " - LP: #2164382 interfaces: u2f-devices | use fido-id udev builtin to", " identify devices", " - LP: #2164689 interfaces: {personal,system}-files | fix profile if", " path has spaces", " - LP: #2106306 check user before deleting snap user data during snap", " removal", " - LP: #2082384 Remove sequence file during snap removal", " - Pass subsystem triggers to udev during snap removal", " - Remove unloaded mount units during snap removal", " - Attempt to refresh just essential snaps when disk space check", " fails", " - Properly consider new and existing revisions during disk space", " checks", " - Add disk-reservation.size option and migrate experimental disk", " space checks", " - Optimize perl and python rules in apparmor template for core24+", " snaps", " - Fix same kernel occupying multiple boot partitions for Little", " Kernel bootloader", " - Graduate quota-groups feature", " - Enable by default refresh-app-awareness-ux feature", " - Ensure that reboots into recovery mode are always oneshots", " - Hide recovery mode entries in hybrid grub menu", " - Fix hybrid remodeling when gadget defines a partition with a", " system-seed role", " - Add seed allowlist to recovery-system creation", " - Improve robustness of seed refresh prerequisites by properly", " merging them", " - Merge selected internal tools into the multi-entry snapd binary", "" ], "package": "snapd", "version": "2.78+ubuntu22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2166403, 2161845, 2161950, 2164382, 2164689, 2106306, 2082384 ], "author": "Katie May ", "date": "Fri, 04 Sep 2026 11:49:14 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2158102", " - Fix undo of unlink-component after its snap revision was discarded", " - interfaces: power-control | allow reading all battery state files", "" ], "package": "snapd", "version": "2.77.1+ubuntu22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2158102 ], "author": "Ernest Lotter ", "date": "Wed, 02 Sep 2026 14:39:12 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2158102", " - Account for differences in names of the binaries in the snapd FIPS", " build", " - Add code to calculate canonical subject name hash", " - Add commands for debugging or accessing snap mount namespaces", " - Add helpers for listing and iterating device mediation groups", " - Add package ebpf with helpers wrapping eBPF exposed objects with", " dependency on github.com/cilium/ebpf", " - Add secondary prerequisites task that acts as the synchronization", " point, which ensures that a snap's prerequisites are available", " before it's installed", " - Add support for shell conditional syntax in envs", " - Added /usr/share/{man,help,info} to system-packages-doc", " - asserts: add validation-sets confdb-schema builtin", " - asserts: ensure that compatibility labels are strings", " - asserts: extend on-classic constraints to accept \"distro/variant\",", " \"distro/*\", and \"distro/\" under a new snap-declaration format 7", " - asserts: validate serial in newDeviceIDFromString", " - Bump github.com/canonical/go-efilib to v1.8.0 to include fixes for", " efivars probe", " - confdb: add validation-sets handler and fix data loss when writing", " to new schemas or accounts", " - confdb: fix bug on reading uneven lists", " - confdb: literal subkeys are sorted after placeholders", " - confdb: run observe-view-* hooks after commit", " - confdb: support Encode/Decode for builtins", " - confdb: support sign-only external keypair backends", " - core-initrd: add missing libbpf and systemd dlopen dependencies,", " and increase mount burst", " - Drop task logs for delayed effects", " - During snap removal, clear-snap task errors early if there are", " user mounts in snap data dirs", " - Enable reverts to trigger a seed refresh", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", " - Ensure that prereqs created by initial refresh run before create-", " recovery-system", " - Exclude Georgian from translation linting", " - experimental features: graduate layouts, classic-preserves-xdg-", " runtime-dir, refresh-app-awareness, and dbus-activation features", " - experimental features: warn when setting graduated or default-", " enabled experimental features and do not store settings for", " graduated features", " - Expose individual certs as well as c_rehash emulation", " - Extend autogen with explicit --sysconfdir", " - External keypair manager: add shared external key manager", " implementation", " - External keypair manager: refactor GPG and external keypair", " managers to use extKeypairMgrImpl", " - External keypair manager: support external OPENPGP signing in", " ExternalKeypairManager", " - FDE: add post install actions API", " - FDE: add reprovision API", " - FDE: add reprovision recovery key generation API", " - FDE: add reseal check after snapd refresh", " - FDE: allow reprovision without factory reset", " - FDE: change makebootable part of the boot package to not take", " install observers as parameters", " - FDE: extend storage-encrypted system information", " - FDE: make reprovision only seal", " - FDE: remove all tmp keyslots on error", " - FDE: remove check for unchanged authentication options", " - FDE: run post install checks during auto repair", " - Filter seed-refresh based on model and seed presence", " - Fix failing snap remove when there are snapctl created mounts", " under snap global data dirs", " - Fix postNotices to validate before locking state", " - Guard the ensure check from running on classic", " - Implement remodeling fully in terms of updates", " - Implement ShutDown for HookManager", " - Include variables SNAP_APP_NAME, and when applicable", " SNAP_APP_COMMON_ID, SNAP_APP_DESKTOP_FILE and SNAP_APP_BUS_NAME in", " snap application environments", " - interfaces: add xdg-portal-permission-store interface", " - interfaces: allow gtk css in subdirectories", " - interfaces: allow systemd networkd link property changes via D-Bus", " - interfaces: allow the systemd networkctl command", " - interfaces: allow Wine to execute files accessed via the Document", " Portal", " - interfaces: apparmor-observe | add interface", " - interfaces: attempt to fix content with parallel installs", " - interfaces: devlxd | fix access for LXD containers", " - interfaces: docker | allow connecting to system-wide docker on", " classic", " - interfaces: grant default access to memory.high in a snap's cgroup", " - interfaces: iscsi-initiator | allow access to /var/lib/iscsi/nodes", " - interfaces: kernel-sched-ext-control | add the kernel sched-ext", " control interface implementation", " - interfaces: make polkit and upower implicit on Core systems only", " - interfaces: open-iscsi | add missing state paths", " - interfaces: opengl | expose wsl libraries", " - interfaces: u2f-devices | add atkey PID and relative VID support", " - List dir contents on failure to remove snap base data dir", " - List non-snapctl mounts in snap data dirs", " - LP: #2072331 Validate map keys in JSON config values", " - LP: #2110510 Interfaces: allow reading of /proc/self/smaps_rollup", " - LP: #2143934 Interfaces: network-control, network-manager | allow", " missing resolve1 link setters", " - LP: #2160691 Security logging: strip trailing whitespace from", " audit netlink message payload", " - LP: #2161982 Interfaces: vsock | add interface for VM guest", " services", " - Make arguments of debug mount-namespace consistent with other", " debug commands", " - Make bootloader logging less verbose", " - Make cert manager garbage check run after symlink migration", " - Make secondary prerequisite synchronization task handle same-", " change retries", " - mkversion.sh: do describe in worktrees too", " - multi-entry snapd: merge snap and snapd binaries", " - multi-entry snapd: move debug device-cgroup implementation file", " under cmd/snapd/cli", " - multi-entry snapd: move snap-gpio-helper sources around before", " transitioning to multi-entry dispatch", " - multi-entry snapd: move snapd-apparmor sources to a dedicated tool", " location", " - multi-entry snapd: move source files around in preparation for", " snapd/snap merge", " - multi-entry snapd: move the snap-preseed sources around in", " preparation", " - multi-entry snapd: move the sources of snapctl and snap-exec in", " preparation for the multi-entry dispatch", " - Never create seed refresh tasks during a remodel", " - packaging: assign a default label for /tmp/snap-private-tmp and", " set it during installation", " - packaging: build deb with Go 1.23 for noble and jammy, Go 1.22 for", " focal", " - packaging: drop SNAP_TAGS", " - packaging: drop symlinks for opensuse 15.5/15.6 packaging", " - packaging: fix service startup during install and session-agent", " socket handling on Ubuntu 26.04+", " - packaging: fix stderr redirection", " - packaging: restore gbp.conf output directory for Ubuntu 26.04", " builds", " - packaging: switch to apparmor 5.x with 5 ABI", " - packaging: update bundled AppArmor to 5.0.2 and accept the 5.0 ABI", " when running as deb", " - packaging: use a relative symlink for snapctl and update steam-", " support udev rules", " - Preserve component in hook security tags", " - Prevent removal of seed-refresh snaps when seed-refresh is enabled", " - Refactor base-declaration into 1st class builtin assertion", " - Refactor how the is-originating-from-snap-command advisory check", " works", " - Refactor prerequisites task handler to enable proper seed-refresh", " integration", " - Reintroduce fdstore helpers", " - remote device management: add task to validate request messages", " - remote device management: apply management messages, queue", " response messages, and improve sequencing and redelivery handling", " - Remove osutil unused AtomicWriteFollow flag", " - Remove xerrors dependency", " - Reuse existing seed-refresh implementation for free during single-", " path installation", " - Rework how SnapSetup.SnapPath is used", " - seccomp: allow rseq_slice_yield", " - security logging: add seclog API for administrative actions and", " token create/remove events", " - security logging: add security logging for adding, updating and", " removing a snapd user", " - Set target hostname from install-mode", " - snap-confine: improve loading of BPF programs, retry on failures", " to collect verifier logs", " - snap-confine: use profile and flags= in snap-confine and snap-", " update-ns' AppArmor profiles", " - snap-confine: work around kernel mnt_ns_loop() ordering bug on", " 6.18.x", " - snap: add debug command for listing currently mediated devices for", " a given snap", " - snap: fix self-managed cgroup support checks", " - snap: report hidden file access for paths allowed by home when", " prompting is active", " - snap: report read-only file access for paths allowed by system-", " package-doc", " - snapctl async support: add --format json to snap tasks to be", " consistent with snapctl", " - snapctl async support: add snapctl tasks command", " - snapctl async support: async feature negotiation between snap", " client and daemon", " - snapctl async support: fix snapctl is-ready exit codes", " - snapctl async support: re-enable snapctl async functionality", " - snapshots: restore preserves snapctl created mounts", " - snapshots: save excludes all mount points", " - Support ca-certificate.crt only systems like core26", " - Turn on quota-groups by default", " - Use 0755 for certificate generation directories", " - Use CreateTemp for NewAtomicFile tmp file creation", " - Verify cached downloads in the do path and detect obvious", " corruption", "" ], "package": "snapd", "version": "2.77", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2158102, 2072331, 2110510, 2143934, 2160691, 2161982 ], "author": "Sergio Cazzolato ", "date": "Fri, 24 Jul 2026 20:45:05 -0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20261107 to 20261113", "from_series": "jammy", "to_series": "jammy", "from_serial": "20261107", "to_serial": "20261113", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }