{ "summary": { "snap": { "added": [], "removed": [], "diff": [ "core22", "snapd" ] }, "deb": { "added": [ "linux-headers-5.15.0-190", "linux-headers-5.15.0-190-generic", "linux-image-5.15.0-190-generic", "linux-modules-5.15.0-190-generic" ], "removed": [ "linux-headers-5.15.0-187", "linux-headers-5.15.0-187-generic", "linux-image-5.15.0-187-generic", "linux-modules-5.15.0-187-generic" ], "diff": [ "bind9-dnsutils", "bind9-host", "bind9-libs:s390x", "curl", "libcurl3-gnutls:s390x", "libcurl4:s390x", "libnss-systemd:s390x", "libpam-systemd:s390x", "libperl5.34:s390x", "libpng16-16:s390x", "libpython3.10:s390x", "libpython3.10-minimal:s390x", "libpython3.10-stdlib:s390x", "libssl3:s390x", "libsystemd0:s390x", "libudev1:s390x", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-virtual", "openssl", "perl", "perl-base", "perl-modules-5.34", "python3.10", "python3.10-minimal", "snapd", "systemd", "systemd-sysv", "systemd-timesyncd", "udev", "vim", "vim-common", "vim-runtime", "vim-tiny", "wget", "xxd" ] } }, "diff": { "deb": [ { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.4", "version": "1:9.18.39-0ubuntu0.22.04.4" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.5", "version": "1:9.18.39-0ubuntu0.22.04.5" }, "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incorrect acceptance of NSEC3 records", " - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the", " owning zone in lib/dns/dnssec.c, lib/isc/result.c.", " - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3", " impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,", " bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,", " bin/tests/system/repro_5874_nsec3_parent/server.py,", " bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.", " - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in", " bin/tests/system/nsec3_impersonation/ans1/ans.py,", " bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,", " bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.", " - CVE-2026-10723", " * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to", " unexpected exit", " - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire", " honours the active region in tests/dns/name_test.c.", " - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code", " in dnstap-read in bin/tools/dnstap-read.c.", " - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the", " active region in lib/dns/name.c.", " - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS", " record is rejected in tests/dns/rdata_test.c.", " - CVE-2026-10822", " * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass", " - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA", " record in bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard", " CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,", " bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long", " wildcard expansion in lib/ns/query.c.", " - CVE-2026-11331", " * SECURITY UPDATE: Potential memory usage beyond configured limits", " - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache", " reference counted in bin/tests/system/reclimit/tests.sh, lib/dns/rbtdb.c.", " - CVE-2026-11622", " * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,", " RRSIG, and wildcards", " - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in", " dnssec-signzone in bin/dnssec/dnssec-signzone.c.", " - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records", " were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.", " - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in", " tests/dns/rdata_test.c.", " - CVE-2026-11721", " * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME", " queries in lib/dns/resolver.c.", " - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in", " some CNAME/DNAME queries) in", " bin/tests/system/cname_dname_negcache/ans2/ans.py,", " bin/tests/system/cname_dname_negcache/ns1/bar.test.db,", " bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,", " bin/tests/system/cname_dname_negcache/ns1/root.db,", " bin/tests/system/cname_dname_negcache/ns1/test.db,", " bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,", " bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.", " - CVE-2026-12617", " * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone", " nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns1/root.db,", " bin/tests/system/dnssec_bypass/ns1/test.db,", " bin/tests/system/dnssec_bypass/ns2/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns2/victim.db,", " bin/tests/system/dnssec_bypass/ns3/evil.db,", " bin/tests/system/dnssec_bypass/ns3/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns4/named.conf.j2,", " bin/tests/system/dnssec_bypass/tests_bypass.py.", " - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner", " names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.", " - debian/patches/CVE-2026-13321-3.patch: change", " dns_nsec_requiredtypespresent to dns_nsec_is_legal in", " lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - CVE-2026-13321", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 11:06:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.4", "version": "1:9.18.39-0ubuntu0.22.04.4" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.5", "version": "1:9.18.39-0ubuntu0.22.04.5" }, "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incorrect acceptance of NSEC3 records", " - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the", " owning zone in lib/dns/dnssec.c, lib/isc/result.c.", " - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3", " impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,", " bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,", " bin/tests/system/repro_5874_nsec3_parent/server.py,", " bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.", " - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in", " bin/tests/system/nsec3_impersonation/ans1/ans.py,", " bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,", " bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.", " - CVE-2026-10723", " * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to", " unexpected exit", " - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire", " honours the active region in tests/dns/name_test.c.", " - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code", " in dnstap-read in bin/tools/dnstap-read.c.", " - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the", " active region in lib/dns/name.c.", " - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS", " record is rejected in tests/dns/rdata_test.c.", " - CVE-2026-10822", " * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass", " - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA", " record in bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard", " CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,", " bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long", " wildcard expansion in lib/ns/query.c.", " - CVE-2026-11331", " * SECURITY UPDATE: Potential memory usage beyond configured limits", " - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache", " reference counted in bin/tests/system/reclimit/tests.sh, lib/dns/rbtdb.c.", " - CVE-2026-11622", " * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,", " RRSIG, and wildcards", " - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in", " dnssec-signzone in bin/dnssec/dnssec-signzone.c.", " - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records", " were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.", " - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in", " tests/dns/rdata_test.c.", " - CVE-2026-11721", " * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME", " queries in lib/dns/resolver.c.", " - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in", " some CNAME/DNAME queries) in", " bin/tests/system/cname_dname_negcache/ans2/ans.py,", " bin/tests/system/cname_dname_negcache/ns1/bar.test.db,", " bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,", " bin/tests/system/cname_dname_negcache/ns1/root.db,", " bin/tests/system/cname_dname_negcache/ns1/test.db,", " bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,", " bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.", " - CVE-2026-12617", " * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone", " nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns1/root.db,", " bin/tests/system/dnssec_bypass/ns1/test.db,", " bin/tests/system/dnssec_bypass/ns2/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns2/victim.db,", " bin/tests/system/dnssec_bypass/ns3/evil.db,", " bin/tests/system/dnssec_bypass/ns3/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns4/named.conf.j2,", " bin/tests/system/dnssec_bypass/tests_bypass.py.", " - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner", " names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.", " - debian/patches/CVE-2026-13321-3.patch: change", " dns_nsec_requiredtypespresent to dns_nsec_is_legal in", " lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - CVE-2026-13321", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 11:06:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs:s390x", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.4", "version": "1:9.18.39-0ubuntu0.22.04.4" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.5", "version": "1:9.18.39-0ubuntu0.22.04.5" }, "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-10723", "url": "https://ubuntu.com/security/CVE-2026-10723", "cve_description": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-10822", "url": "https://ubuntu.com/security/CVE-2026-10822", "cve_description": "If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11331", "url": "https://ubuntu.com/security/CVE-2026-11331", "cve_description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11622", "url": "https://ubuntu.com/security/CVE-2026-11622", "cve_description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-11721", "url": "https://ubuntu.com/security/CVE-2026-11721", "cve_description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-12617", "url": "https://ubuntu.com/security/CVE-2026-12617", "cve_description": "The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" }, { "cve": "CVE-2026-13321", "url": "https://ubuntu.com/security/CVE-2026-13321", "cve_description": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.", "cve_priority": "medium", "cve_public_date": "2026-07-22 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incorrect acceptance of NSEC3 records", " - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the", " owning zone in lib/dns/dnssec.c, lib/isc/result.c.", " - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3", " impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py,", " bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2,", " bin/tests/system/repro_5874_nsec3_parent/server.py,", " bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py.", " - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in", " bin/tests/system/nsec3_impersonation/ans1/ans.py,", " bin/tests/system/nsec3_impersonation/ns2/named.conf.j2,", " bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py.", " - CVE-2026-10723", " * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to", " unexpected exit", " - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire", " honours the active region in tests/dns/name_test.c.", " - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code", " in dnstap-read in bin/tools/dnstap-read.c.", " - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the", " active region in lib/dns/name.c.", " - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS", " record is rejected in tests/dns/rdata_test.c.", " - CVE-2026-10822", " * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass", " - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA", " record in bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard", " CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db,", " bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh.", " - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long", " wildcard expansion in lib/ns/query.c.", " - CVE-2026-11331", " * SECURITY UPDATE: Potential memory usage beyond configured limits", " - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache", " reference counted in bin/tests/system/reclimit/tests.sh, lib/dns/rbtdb.c.", " - CVE-2026-11622", " * SECURITY UPDATE: Cache poisoning possible with label count discrepancy,", " RRSIG, and wildcards", " - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in", " dnssec-signzone in bin/dnssec/dnssec-signzone.c.", " - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records", " were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c.", " - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in", " tests/dns/rdata_test.c.", " - CVE-2026-11721", " * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME", " queries in lib/dns/resolver.c.", " - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in", " some CNAME/DNAME queries) in", " bin/tests/system/cname_dname_negcache/ans2/ans.py,", " bin/tests/system/cname_dname_negcache/ns1/bar.test.db,", " bin/tests/system/cname_dname_negcache/ns1/named.conf.j2,", " bin/tests/system/cname_dname_negcache/ns1/root.db,", " bin/tests/system/cname_dname_negcache/ns1/test.db,", " bin/tests/system/cname_dname_negcache/ns3/named.conf.j2,", " bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py.", " - CVE-2026-12617", " * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME", " - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone", " nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns1/root.db,", " bin/tests/system/dnssec_bypass/ns1/test.db,", " bin/tests/system/dnssec_bypass/ns2/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns2/victim.db,", " bin/tests/system/dnssec_bypass/ns3/evil.db,", " bin/tests/system/dnssec_bypass/ns3/named.conf.j2,", " bin/tests/system/dnssec_bypass/ns4/named.conf.j2,", " bin/tests/system/dnssec_bypass/tests_bypass.py.", " - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner", " names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h.", " - debian/patches/CVE-2026-13321-3.patch: change", " dns_nsec_requiredtypespresent to dns_nsec_is_legal in", " lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - CVE-2026-13321", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 11:06:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.25", "version": "7.81.0-1ubuntu1.25" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.27", "version": "7.81.0-1ubuntu1.27" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, ../url.c, lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,", " ../sectransp.c, ../vtls.c, ../nss.c, and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.27", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Fri, 21 Aug 2026 12:40:03 -0600" }, { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.26", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 16:14:14 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl3-gnutls:s390x", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.25", "version": "7.81.0-1ubuntu1.25" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.27", "version": "7.81.0-1ubuntu1.27" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, ../url.c, lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,", " ../sectransp.c, ../vtls.c, ../nss.c, and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.27", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Fri, 21 Aug 2026 12:40:03 -0600" }, { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.26", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 16:14:14 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4:s390x", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.25", "version": "7.81.0-1ubuntu1.25" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.27", "version": "7.81.0-1ubuntu1.27" }, "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass in connection reuse.", " - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in", " lib/ldap.c, ../urldata.h, ../url.c, lib/vssh/libssh.c, ../libssh2.c,", " lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,", " ../sectransp.c, ../vtls.c, ../nss.c, and ../wolfssl.c.", " - CVE-2026-8932", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.27", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Fri, 21 Aug 2026 12:40:03 -0600" }, { "cves": [ { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.26", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 16:14:14 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnss-systemd:s390x", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-systemd:s390x", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.34:s390x", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.8", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpng16-16:s390x", "from_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.5", "version": "1.6.37-3ubuntu0.5" }, "to_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.6", "version": "1.6.37-3ubuntu0.6" }, "cves": [ { "cve": "CVE-2026-40930", "url": "https://ubuntu.com/security/CVE-2026-40930", "cve_description": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-06-04 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-40930", "url": "https://ubuntu.com/security/CVE-2026-40930", "cve_description": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-06-04 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Interpretation conflict in APNG parser", " paths.", " - debian/patches/CVE-2026-40930.patch: Restructure the trailing-fdAT", " path in pngpread.c", " - debian/patches/CVE-2026-40930-post1.patch: Fix hardcoded length in", " png_ensure_sequence_number in pngpread.c", " - CVE-2026-40930", "" ], "package": "libpng1.6", "version": "1.6.37-3ubuntu0.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 13 Aug 2026 10:20:26 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10:s390x", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.16", "version": "3.10.12-1~22.04.16" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.17", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:40:17 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10-minimal:s390x", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.16", "version": "3.10.12-1~22.04.16" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.17", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:40:17 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.10-stdlib:s390x", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.16", "version": "3.10.12-1~22.04.16" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.17", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:40:17 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssl3:s390x", "from_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.26", "version": "3.0.2-0ubuntu1.26" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.29", "version": "3.0.2-0ubuntu1.29" }, "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "launchpad_bugs_fixed": [ 2130576 ], "changes": [ { "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "log": [ "", " * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future", " Epoch", " - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation", " when buffering DTLS records in ssl/record/rec_layer_d1.c,", " ssl/record/record.h, ssl/record/ssl3_record.c.", " - debian/patches/CVE-2026-54874-2.patch: ssl/record: lower the DTLS", " unprocessed_rcds queue limit in ssl/record/rec_layer_d1.c,", " ssl/record/record_local.h, ssl/record/ssl3_record.c.", " - CVE-2026-54874", " * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping", " - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in", " test/cmsapitest.c, test/recipes/80-test_cmsapi.t.", " - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte", " OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.", " - CVE-2026-63072", " * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts", " - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth", " in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,", " test/recipes/65-test_cmp_msg.t.", " - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in", " cmp in crypto/cmp/cmp_vfy.c.", " - CVE-2026-63074", " * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg", " - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in", " test/cmp_protect_test.c.", " - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in", " ossl_cmp_calc_protection() via crafted protectionAlg in", " crypto/cmp/cmp_protect.c.", " - CVE-2026-63076", " * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()", " - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()", " finalize: Poly1305 and OCB AEADs in", " providers/implementations/ciphers/cipher_aes_ocb.c,", " providers/implementations/ciphers/cipher_chacha20_poly1305.c.", " - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD", " EVP_Cipher() finalization in test/evp_extra_test.c.", " - CVE-2026-75803", "" ], "package": "openssl", "version": "3.0.2-0ubuntu1.29", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 18 Aug 2026 08:18:41 -0400" }, { "cves": [], "log": [ "", " * Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit", " architectures (LP: #2130576).", " Thanks to Szilárd Pfeiffer for the", " bug report and patch.", "" ], "package": "openssl", "version": "3.0.2-0ubuntu1.27", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2130576 ], "author": "Ravi Kant Sharma ", "date": "Wed, 12 Aug 2026 15:10:04 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd0:s390x", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudev1:s390x", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.187.167", "version": "5.15.0.187.167" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.190.169", "version": "5.15.0.190.169" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-190", "" ], "package": "linux-meta", "version": "5.15.0.190.169", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 15:32:37 +0200" }, { "cves": [], "log": [ "", " * Bump ABI 5.15.0-188", "" ], "package": "linux-meta", "version": "5.15.0.188.168", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:45 +0200" }, { "cves": [], "log": [ "", " * Bump version for rebuild", "" ], "package": "linux-meta", "version": "5.15.0.186.167", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Vinicius Peixoto ", "date": "Sat, 18 Jul 2026 13:04:07 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.187.167", "version": "5.15.0.187.167" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.190.169", "version": "5.15.0.190.169" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-190", "" ], "package": "linux-meta", "version": "5.15.0.190.169", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 15:32:37 +0200" }, { "cves": [], "log": [ "", " * Bump ABI 5.15.0-188", "" ], "package": "linux-meta", "version": "5.15.0.188.168", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:45 +0200" }, { "cves": [], "log": [ "", " * Bump version for rebuild", "" ], "package": "linux-meta", "version": "5.15.0.186.167", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Vinicius Peixoto ", "date": "Sat, 18 Jul 2026 13:04:07 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.187.167", "version": "5.15.0.187.167" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.190.169", "version": "5.15.0.190.169" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-190", "" ], "package": "linux-meta", "version": "5.15.0.190.169", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 15:32:37 +0200" }, { "cves": [], "log": [ "", " * Bump ABI 5.15.0-188", "" ], "package": "linux-meta", "version": "5.15.0.188.168", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:45 +0200" }, { "cves": [], "log": [ "", " * Bump version for rebuild", "" ], "package": "linux-meta", "version": "5.15.0.186.167", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Vinicius Peixoto ", "date": "Sat, 18 Jul 2026 13:04:07 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.187.167", "version": "5.15.0.187.167" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "5.15.0.190.169", "version": "5.15.0.190.169" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump ABI 5.15.0-190", "" ], "package": "linux-meta", "version": "5.15.0.190.169", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 15:32:37 +0200" }, { "cves": [], "log": [ "", " * Bump ABI 5.15.0-188", "" ], "package": "linux-meta", "version": "5.15.0.188.168", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:45 +0200" }, { "cves": [], "log": [ "", " * Bump version for rebuild", "" ], "package": "linux-meta", "version": "5.15.0.186.167", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Vinicius Peixoto ", "date": "Sat, 18 Jul 2026 13:04:07 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl", "from_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.26", "version": "3.0.2-0ubuntu1.26" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.29", "version": "3.0.2-0ubuntu1.29" }, "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "launchpad_bugs_fixed": [ 2130576 ], "changes": [ { "cves": [ { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "CMP Indefinite Cache Growth of ExtraCerts", "cve_priority": "low", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "cve_priority": "medium", "cve_public_date": "2026-08-25" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()", "cve_priority": "low", "cve_public_date": "2026-08-25" } ], "log": [ "", " * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future", " Epoch", " - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation", " when buffering DTLS records in ssl/record/rec_layer_d1.c,", " ssl/record/record.h, ssl/record/ssl3_record.c.", " - debian/patches/CVE-2026-54874-2.patch: ssl/record: lower the DTLS", " unprocessed_rcds queue limit in ssl/record/rec_layer_d1.c,", " ssl/record/record_local.h, ssl/record/ssl3_record.c.", " - CVE-2026-54874", " * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping", " - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in", " test/cmsapitest.c, test/recipes/80-test_cmsapi.t.", " - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte", " OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.", " - CVE-2026-63072", " * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts", " - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth", " in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,", " test/recipes/65-test_cmp_msg.t.", " - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in", " cmp in crypto/cmp/cmp_vfy.c.", " - CVE-2026-63074", " * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg", " - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in", " test/cmp_protect_test.c.", " - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in", " ossl_cmp_calc_protection() via crafted protectionAlg in", " crypto/cmp/cmp_protect.c.", " - CVE-2026-63076", " * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()", " - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()", " finalize: Poly1305 and OCB AEADs in", " providers/implementations/ciphers/cipher_aes_ocb.c,", " providers/implementations/ciphers/cipher_chacha20_poly1305.c.", " - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD", " EVP_Cipher() finalization in test/evp_extra_test.c.", " - CVE-2026-75803", "" ], "package": "openssl", "version": "3.0.2-0ubuntu1.29", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 18 Aug 2026 08:18:41 -0400" }, { "cves": [], "log": [ "", " * Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit", " architectures (LP: #2130576).", " Thanks to Szilárd Pfeiffer for the", " bug report and patch.", "" ], "package": "openssl", "version": "3.0.2-0ubuntu1.27", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2130576 ], "author": "Ravi Kant Sharma ", "date": "Wed, 12 Aug 2026 15:10:04 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.8", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.8", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.34", "from_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.7", "version": "5.34.0-3ubuntu1.7" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.34.0-3ubuntu1.8", "version": "5.34.0-3ubuntu1.8" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", "" ], "package": "perl", "version": "5.34.0-3ubuntu1.8", "urgency": "high", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:25 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.10", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.16", "version": "3.10.12-1~22.04.16" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.17", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:40:17 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.10-minimal", "from_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.16", "version": "3.10.12-1~22.04.16" }, "to_version": { "source_package_name": "python3.10", "source_package_version": "3.10.12-1~22.04.17", "version": "3.10.12-1~22.04.17" }, "cves": [], "launchpad_bugs_fixed": [ 2157534 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp-2157534-ssl-memory-leak.patch: Fixes a memory leak", " in ssl.SSLSocket.session. (LP: #2157534)", "" ], "package": "python3.10", "version": "3.10.12-1~22.04.17", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2157534 ], "author": "Finn Rayk Gartner ", "date": "Thu, 16 Jul 2026 01:40:17 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.76+ubuntu22.04.1", "version": "2.76+ubuntu22.04.1" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu22.04", "version": "2.76.3+ubuntu22.04" }, "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158301, 2159940, 2157692, 2067006 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2158301", " - FDE: support keyboard configuration at install-time for first-boot", " - FDE: re-enable passphrases/PINs at install-time", " - FDE: require volumes authentication if HWROT is missing", " - FDE: bump secboot to rev 457b03a16d19", " - FDE: use new secboot API for reprovision TPM", " - Cross-distro: modify SELinux policy to use", " init_named_socket_activation() for allowing systemd to start snapd", " through socket activation", " - packaging: make sure that usr/bin/snap is built with correct build", " tags on debian sid", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", "" ], "package": "snapd", "version": "2.76.3+ubuntu22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2158301 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 10:06:48 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2159940", " - interfaces: steam-support, docker-support | fix mountinfo denial", "" ], "package": "snapd", "version": "2.76.2+ubuntu22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2159940 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 08:38:51 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", "" ], "package": "snapd", "version": "2.76.1+ubuntu22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Thu, 25 Jun 2026 13:09:05 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-sysv", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-timesyncd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "udev", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.21", "version": "249.11-0ubuntu3.21" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: systemd: crash triggered by unprivileged users in various", " components via Varlink", " - GHSA-5rm9-cc37-35gq.patch", " - GHSA-5rm9-cc37-35gq", " * SECURITY UPDATE: udev: local root execution via malicious iscsi devices", " and unsanitized kernel output", " - GHSA-m8q3-73v4-wvg7.patch", " - GHSA-m8q3-73v4-wvg7", " * SECURITY UPDATE: crash triggered by unprivileged users in various", " components via D-Bus/Varlink", " - basic-strv-add-optimizable-version-of-strv_push-consume-e.patch", " - core-limit-the-number-of-units-that-can-be-requested-over.patch", " - dbus-limit-the-number-of-env-variables-to-something-reaso.patch", " - dbus-manager-limit-the-number-of-states-patterns-per-quer.patch", " - resolve-enforce-the-search-domain-limit-earlier.patch", " - resolve-limit-the-number-NTAs-to-something-sensible.patch", " - sd-bus-store-the-strv-size-when-extending-it.patch", " - sd-json-user-record-store-the-strv-size-when-extending-it.patch", " - GHSA-3jgj-3phh-hx5j", "" ], "package": "systemd", "version": "249.11-0ubuntu3.22", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 29 Jul 2026 09:41:27 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.36", "version": "2:8.2.3995-1ubuntu2.36" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.36", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:24 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim and", " ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.35", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 15:47:19 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-common", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.36", "version": "2:8.2.3995-1ubuntu2.36" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.36", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:24 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim and", " ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.35", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 15:47:19 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-runtime", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.36", "version": "2:8.2.3995-1ubuntu2.36" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.36", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:24 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim and", " ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.35", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 15:47:19 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-tiny", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.36", "version": "2:8.2.3995-1ubuntu2.36" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.36", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:24 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim and", " ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.35", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 15:47:19 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "wget", "from_version": { "source_package_name": "wget", "source_package_version": "1.21.2-2ubuntu1.4", "version": "1.21.2-2ubuntu1.4" }, "to_version": { "source_package_name": "wget", "source_package_version": "1.21.2-2ubuntu1.5", "version": "1.21.2-2ubuntu1.5" }, "cves": [ { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163754 ], "changes": [ { "cves": [ { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-58472 (LP: #2163754)", " - debian/patches/CVE-2026-58472-post1.patch: Fix buffer overflow in", " src/convert.c", "" ], "package": "wget", "version": "1.21.2-2ubuntu1.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2163754 ], "author": "Kyle Kernick ", "date": "Wed, 19 Aug 2026 18:01:10 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "xxd", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.36", "version": "2:8.2.3995-1ubuntu2.36" }, "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" }, { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163785 ], "changes": [ { "cves": [ { "cve": "CVE-2026-73073", "url": "https://ubuntu.com/security/CVE-2026-73073", "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)", "cve_priority": "medium", "cve_public_date": "2026-08-19" } ], "log": [ "", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in", " runtime/autoload/ccomplete.vim.", " - CVE-2026-73073", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.36", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 24 Aug 2026 16:13:24 -0600" }, { "cves": [ { "cve": "CVE-2026-28417", "url": "https://ubuntu.com/security/CVE-2026-28417", "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.", "cve_priority": "medium", "cve_public_date": "2026-02-27 22:16:00 UTC" }, { "cve": "CVE-2026-73071", "url": "https://ubuntu.com/security/CVE-2026-73071", "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73072", "url": "https://ubuntu.com/security/CVE-2026-73072", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73074", "url": "https://ubuntu.com/security/CVE-2026-73074", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73076", "url": "https://ubuntu.com/security/CVE-2026-73076", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73077", "url": "https://ubuntu.com/security/CVE-2026-73077", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" }, { "cve": "CVE-2026-73078", "url": "https://ubuntu.com/security/CVE-2026-73078", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.", "cve_priority": "medium", "cve_public_date": "2026-08-11 16:17:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)", " - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in", " runtime/autoload/netrw.vim", " - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname", " in runtime/autoload/netrw.vim", " * SECURITY UPDATE: Use-after-free on json decode error.", " - debian/patches/CVE-2026-73071.patch: Report the position from the", " current reader in src/json.c.", " - CVE-2026-73071", " * SECURITY UPDATE: Heap buffer overflow in set_sofo().", " - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in", " src/spellfile.c.", " - CVE-2026-73072", " * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.", " - debian/patches/CVE-2026-73074.patch: Verify that the number of text", " properties falls within the limit in src/errors.h and src/textprop.c.", " - CVE-2026-73074", " * SECURITY UPDATE: Code execution via VimballRecord file.", " - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix", " broken directory deletion code, and refactor code in", " runtime/autoload/vimball.vim", " - CVE-2026-73076", " * SECURITY UPDATE: Arbitrary code execution via keyword lookup.", " - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands", " using single quotes, for zsh pass the argument as a separate list", " item to term_start()/system() in runtime/ftplugin/ps1.vim and", " ../zsh.vim.", " - CVE-2026-73077", " * SECURITY UPDATE: Code injection in netrw via bookmarks.", " - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in", " runtime/autoload/netrw.vim.", " - CVE-2026-73078", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.35", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2163785 ], "author": "Kyle Kernick ", "date": "Tue, 18 Aug 2026 15:47:19 -0600" } ], "notes": null, "is_version_downgrade": false } ], "snap": [ { "name": "core22", "from_version": { "source_package_name": null, "source_package_version": null, "version": "2416" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "2442" } }, { "name": "snapd", "from_version": { "source_package_name": null, "source_package_version": null, "version": "27593" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "27720" } } ] }, "added": { "deb": [ { "name": "linux-headers-5.15.0-190", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-187.197", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163031, 2162294 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", "", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "" ], "package": "linux", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2163031 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 14:57:54 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162294 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:32 +0200" } ], "notes": "linux-headers-5.15.0-190 version '5.15.0-190.200' (source package linux version '5.15.0-190.200') was added. linux-headers-5.15.0-190 version '5.15.0-190.200' has the same source package name, linux, as removed package linux-headers-5.15.0-187. As such we can use the source package version of the removed package, '5.15.0-187.197', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-headers-5.15.0-190-generic", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-187.197", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163031, 2162294 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", "", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "" ], "package": "linux", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2163031 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 14:57:54 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162294 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:32 +0200" } ], "notes": "linux-headers-5.15.0-190-generic version '5.15.0-190.200' (source package linux version '5.15.0-190.200') was added. linux-headers-5.15.0-190-generic version '5.15.0-190.200' has the same source package name, linux, as removed package linux-headers-5.15.0-187. As such we can use the source package version of the removed package, '5.15.0-187.197', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-5.15.0-190-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "5.15.0-187.197", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 1786013, 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 5.15.0-190.200", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1786013 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 15:32:46 +0200" }, { "cves": [], "log": [ "", " * Main version: 5.15.0-188.198", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:32:03 +0200" }, { "cves": [], "log": [ "", " * Main version: 5.15.0-186.196i1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "5.15.0-186.196i1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1786013 ], "author": "Vinicius Peixoto ", "date": "Sat, 18 Jul 2026 13:04:18 -0300" } ], "notes": "linux-image-5.15.0-190-generic version '5.15.0-190.200' (source package linux-signed version '5.15.0-190.200') was added. linux-image-5.15.0-190-generic version '5.15.0-190.200' has the same source package name, linux-signed, as removed package linux-image-5.15.0-187-generic. As such we can use the source package version of the removed package, '5.15.0-187.197', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-5.15.0-190-generic", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-187.197", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "5.15.0-190.200", "version": "5.15.0-190.200" }, "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163031, 2162294 ], "changes": [ { "cves": [ { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)", "", " * CVE-2026-53246", " - sctp: delete the nested flexible array peer_init", "" ], "package": "linux", "version": "5.15.0-190.200", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2163031 ], "author": "Manuel Diewald ", "date": "Fri, 07 Aug 2026 14:57:54 +0200" }, { "cves": [ { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" } ], "log": [ "", " * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "" ], "package": "linux", "version": "5.15.0-188.198", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2162294 ], "author": "Edoardo Canepa ", "date": "Fri, 31 Jul 2026 23:31:32 +0200" } ], "notes": "linux-modules-5.15.0-190-generic version '5.15.0-190.200' (source package linux version '5.15.0-190.200') was added. linux-modules-5.15.0-190-generic version '5.15.0-190.200' has the same source package name, linux, as removed package linux-headers-5.15.0-187. As such we can use the source package version of the removed package, '5.15.0-187.197', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-5.15.0-187", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-187.197", "version": "5.15.0-187.197" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-5.15.0-187-generic", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-187.197", "version": "5.15.0-187.197" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-5.15.0-187-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "5.15.0-187.197", "version": "5.15.0-187.197" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-5.15.0-187-generic", "from_version": { "source_package_name": "linux", "source_package_version": "5.15.0-187.197", "version": "5.15.0-187.197" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20260807 to 20260826", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260807", "to_serial": "20260826", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }