{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "libarchive13:riscv64", "libntfs-3g89", "libsqlite3-0:riscv64", "ntfs-3g", "openssh-client", "openssh-server", "openssh-sftp-server", "python3-httplib2", "python3-idna", "snapd", "tar", "ubuntu-advantage-tools", "ubuntu-pro-client", "ubuntu-pro-client-l10n", "vim", "vim-common", "vim-runtime", "vim-tiny", "wget", "xxd" ] } }, "diff": { "deb": [ { "name": "libarchive13:riscv64", "from_version": { "source_package_name": "libarchive", "source_package_version": "3.6.0-1ubuntu1.7", "version": "3.6.0-1ubuntu1.7" }, "to_version": { "source_package_name": "libarchive", "source_package_version": "3.6.0-1ubuntu1.8", "version": "3.6.0-1ubuntu1.8" }, "cves": [ { "cve": "CVE-2026-14164", "url": "https://ubuntu.com/security/CVE-2026-14164", "cve_description": "A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 07:16:00 UTC" }, { "cve": "CVE-2026-5745", "url": "https://ubuntu.com/security/CVE-2026-5745", "cve_description": "A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).", "cve_priority": "medium", "cve_public_date": "2026-04-07 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-14164", "url": "https://ubuntu.com/security/CVE-2026-14164", "cve_description": "A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 07:16:00 UTC" }, { "cve": "CVE-2026-5745", "url": "https://ubuntu.com/security/CVE-2026-5745", "cve_description": "A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).", "cve_priority": "medium", "cve_public_date": "2026-04-07 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Double free in init_unpack.", " - debian/patches/CVE-2026-14164.patch: Avoid dangling pointers in", " libarchive/archive_read_support_format_rar5.c", " - CVE-2026-14164", " * SECURITY UPDATE: NULL pointer dereference in archive_acl_from_text_nl.", " - debian/patches/CVE-2026-5745.patch: Fix NULL pointer dereference in", " libarchive/archive_acl.c", " - CVE-2026-5745", "" ], "package": "libarchive", "version": "3.6.0-1ubuntu1.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 20 Jul 2026 13:49:30 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libntfs-3g89", "from_version": { "source_package_name": "ntfs-3g", "source_package_version": "1:2021.8.22-3ubuntu1.3", "version": "1:2021.8.22-3ubuntu1.3" }, "to_version": { "source_package_name": "ntfs-3g", "source_package_version": "1:2021.8.22-3ubuntu1.4", "version": "1:2021.8.22-3ubuntu1.4" }, "cves": [ { "cve": "CVE-2026-42616", "url": "https://ubuntu.com/security/CVE-2026-42616", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in cat() in cat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42617", "url": "https://ubuntu.com/security/CVE-2026-42617", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46572", "url": "https://ubuntu.com/security/CVE-2026-46572", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56136", "url": "https://ubuntu.com/security/CVE-2026-56136", "cve_description": "In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42618", "url": "https://ubuntu.com/security/CVE-2026-42618", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46569", "url": "https://ubuntu.com/security/CVE-2026-46569", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46570", "url": "https://ubuntu.com/security/CVE-2026-46570", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading crafted file metadata.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46571", "url": "https://ubuntu.com/security/CVE-2026-46571", "cve_description": "In NTFS-3G through 2026.2.25, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56135", "url": "https://ubuntu.com/security/CVE-2026-56135", "cve_description": "In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42616", "url": "https://ubuntu.com/security/CVE-2026-42616", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in cat() in cat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42617", "url": "https://ubuntu.com/security/CVE-2026-42617", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46572", "url": "https://ubuntu.com/security/CVE-2026-46572", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56136", "url": "https://ubuntu.com/security/CVE-2026-56136", "cve_description": "In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42618", "url": "https://ubuntu.com/security/CVE-2026-42618", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46569", "url": "https://ubuntu.com/security/CVE-2026-46569", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46570", "url": "https://ubuntu.com/security/CVE-2026-46570", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading crafted file metadata.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46571", "url": "https://ubuntu.com/security/CVE-2026-46571", "cve_description": "In NTFS-3G through 2026.2.25, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56135", "url": "https://ubuntu.com/security/CVE-2026-56135", "cve_description": "In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow in cat()", " - debian/patches/CVE-2026-42616.patch: Fix logic in ntfsprogs/ntfscat.c.", " - CVE-2026-42616", " * SECURITY UPDATE: buffer overflows and OOB read", " - debian/patches/CVE-2026-42617_46572_56136.patch: Fix logic in", " include/ntfs-3g/index.h, libntfs-3g/attrib.c, libntfs-3g/index.c.", " - CVE-2026-42617", " - CVE-2026-46572", " - CVE-2026-56136", " * SECURITY UPDATE: heap buffer overflow in ntfs_decompress()", " - debian/patches/CVE-2026-42618.patch: Fix logic in libntfs-3g/compress.c.", " - CVE-2026-42618", " * SECURITY UPDATE: heap buffer overflow in ntfs_ib_copy_tail()", " - debian/patches/CVE-2026-46569.patch: Fix logic in libntfs-3g/index.c.", " - CVE-2026-46569", " * SECURITY UPDATE: heap buffer overflow in ntfs_index_walk_down()", " - debian/patches/CVE-2026-46570.patch: Fix logic in libntfs-3g/index.c.", " - CVE-2026-46570", " * SECURITY UPDATE: out-of-bounds read in ntfs_fix_file_name()", " - debian/patches/CVE-2026-46571.patch: Fix logic in libntfs-3g/reparse.c.", " - CVE-2026-46571", " * SECURITY UPDATE: heap-based overflow in function build_inherited_id()", " - debian/patches/CVE-2026-56135.patch: Fix logic in include/ntfs-3g/acls.h,", " libntfs-3g/acls.c, libntfs-3g/security.c.", " - CVE-2026-56135", "" ], "package": "ntfs-3g", "version": "1:2021.8.22-3ubuntu1.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Sat, 11 Jul 2026 11:55:48 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsqlite3-0:riscv64", "from_version": { "source_package_name": "sqlite3", "source_package_version": "3.37.2-2ubuntu0.6", "version": "3.37.2-2ubuntu0.6" }, "to_version": { "source_package_name": "sqlite3", "source_package_version": "3.37.2-2ubuntu0.7", "version": "3.37.2-2ubuntu0.7" }, "cves": [ { "cve": "CVE-2026-50812", "url": "https://ubuntu.com/security/CVE-2026-50812", "cve_description": "A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.", "cve_priority": "medium", "cve_public_date": "2026-07-08 18:16:00 UTC" }, { "cve": "CVE-2026-50813", "url": "https://ubuntu.com/security/CVE-2026-50813", "cve_description": "An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path", "cve_priority": "medium", "cve_public_date": "2026-07-08 18:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-50812", "url": "https://ubuntu.com/security/CVE-2026-50812", "cve_description": "A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.", "cve_priority": "medium", "cve_public_date": "2026-07-08 18:16:00 UTC" }, { "cve": "CVE-2026-50813", "url": "https://ubuntu.com/security/CVE-2026-50813", "cve_description": "An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path", "cve_priority": "medium", "cve_public_date": "2026-07-08 18:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: NULL pointer dereference in the SQLite Session Extension", " - debian/patches/CVE-2026-50812.patch: Fix a bug causing the session module", " to dereference a NULL pointer when applying a corrupt changeset. in", " ext/session/session9.test, ext/session/sqlite3session.c.", " - CVE-2026-50812", " * SECURITY UPDATE: sensitive information disclosure via the Session Extension", " - debian/patches/CVE-2026-50813.patch: Fix a buffer overread in the session", " module that could occur when processing a corrupt changeset. in", " ext/session/sessionC.test, ext/session/sqlite3session.c.", " - CVE-2026-50813", "" ], "package": "sqlite3", "version": "3.37.2-2ubuntu0.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 13:13:10 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ntfs-3g", "from_version": { "source_package_name": "ntfs-3g", "source_package_version": "1:2021.8.22-3ubuntu1.3", "version": "1:2021.8.22-3ubuntu1.3" }, "to_version": { "source_package_name": "ntfs-3g", "source_package_version": "1:2021.8.22-3ubuntu1.4", "version": "1:2021.8.22-3ubuntu1.4" }, "cves": [ { "cve": "CVE-2026-42616", "url": "https://ubuntu.com/security/CVE-2026-42616", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in cat() in cat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42617", "url": "https://ubuntu.com/security/CVE-2026-42617", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46572", "url": "https://ubuntu.com/security/CVE-2026-46572", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56136", "url": "https://ubuntu.com/security/CVE-2026-56136", "cve_description": "In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42618", "url": "https://ubuntu.com/security/CVE-2026-42618", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46569", "url": "https://ubuntu.com/security/CVE-2026-46569", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46570", "url": "https://ubuntu.com/security/CVE-2026-46570", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading crafted file metadata.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46571", "url": "https://ubuntu.com/security/CVE-2026-46571", "cve_description": "In NTFS-3G through 2026.2.25, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56135", "url": "https://ubuntu.com/security/CVE-2026-56135", "cve_description": "In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42616", "url": "https://ubuntu.com/security/CVE-2026-42616", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in cat() in cat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42617", "url": "https://ubuntu.com/security/CVE-2026-42617", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46572", "url": "https://ubuntu.com/security/CVE-2026-46572", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56136", "url": "https://ubuntu.com/security/CVE-2026-56136", "cve_description": "In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-42618", "url": "https://ubuntu.com/security/CVE-2026-42618", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46569", "url": "https://ubuntu.com/security/CVE-2026-46569", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46570", "url": "https://ubuntu.com/security/CVE-2026-46570", "cve_description": "In NTFS-3G through 2026.2.25, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading crafted file metadata.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-46571", "url": "https://ubuntu.com/security/CVE-2026-46571", "cve_description": "In NTFS-3G through 2026.2.25, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" }, { "cve": "CVE-2026-56135", "url": "https://ubuntu.com/security/CVE-2026-56135", "cve_description": "In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.", "cve_priority": "medium", "cve_public_date": "2026-07-15 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow in cat()", " - debian/patches/CVE-2026-42616.patch: Fix logic in ntfsprogs/ntfscat.c.", " - CVE-2026-42616", " * SECURITY UPDATE: buffer overflows and OOB read", " - debian/patches/CVE-2026-42617_46572_56136.patch: Fix logic in", " include/ntfs-3g/index.h, libntfs-3g/attrib.c, libntfs-3g/index.c.", " - CVE-2026-42617", " - CVE-2026-46572", " - CVE-2026-56136", " * SECURITY UPDATE: heap buffer overflow in ntfs_decompress()", " - debian/patches/CVE-2026-42618.patch: Fix logic in libntfs-3g/compress.c.", " - CVE-2026-42618", " * SECURITY UPDATE: heap buffer overflow in ntfs_ib_copy_tail()", " - debian/patches/CVE-2026-46569.patch: Fix logic in libntfs-3g/index.c.", " - CVE-2026-46569", " * SECURITY UPDATE: heap buffer overflow in ntfs_index_walk_down()", " - debian/patches/CVE-2026-46570.patch: Fix logic in libntfs-3g/index.c.", " - CVE-2026-46570", " * SECURITY UPDATE: out-of-bounds read in ntfs_fix_file_name()", " - debian/patches/CVE-2026-46571.patch: Fix logic in libntfs-3g/reparse.c.", " - CVE-2026-46571", " * SECURITY UPDATE: heap-based overflow in function build_inherited_id()", " - debian/patches/CVE-2026-56135.patch: Fix logic in include/ntfs-3g/acls.h,", " libntfs-3g/acls.c, libntfs-3g/security.c.", " - CVE-2026-56135", "" ], "package": "ntfs-3g", "version": "1:2021.8.22-3ubuntu1.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Sat, 11 Jul 2026 11:55:48 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.15", "version": "1:8.9p1-3ubuntu0.15" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.16", "version": "1:8.9p1-3ubuntu0.16" }, "cves": [ { "cve": "CVE-2026-59995", "url": "https://ubuntu.com/security/CVE-2026-59995", "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59996", "url": "https://ubuntu.com/security/CVE-2026-59996", "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59997", "url": "https://ubuntu.com/security/CVE-2026-59997", "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59998", "url": "https://ubuntu.com/security/CVE-2026-59998", "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59999", "url": "https://ubuntu.com/security/CVE-2026-59999", "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60000", "url": "https://ubuntu.com/security/CVE-2026-60000", "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60001", "url": "https://ubuntu.com/security/CVE-2026-60001", "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60002", "url": "https://ubuntu.com/security/CVE-2026-60002", "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59995", "url": "https://ubuntu.com/security/CVE-2026-59995", "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59996", "url": "https://ubuntu.com/security/CVE-2026-59996", "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59997", "url": "https://ubuntu.com/security/CVE-2026-59997", "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59998", "url": "https://ubuntu.com/security/CVE-2026-59998", "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59999", "url": "https://ubuntu.com/security/CVE-2026-59999", "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60000", "url": "https://ubuntu.com/security/CVE-2026-60000", "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60001", "url": "https://ubuntu.com/security/CVE-2026-60001", "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60002", "url": "https://ubuntu.com/security/CVE-2026-60002", "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp downloaded files location issue", " - debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-", " controlled path when performing in sftp.c.", " - CVE-2026-59995", " * SECURITY UPDATE: scp parent directory issue", " - debian/patches/CVE-2026-59996.patch: upstream: resist that return \"..\" via", " remote glob during in scp.c.", " - CVE-2026-59996", " * SECURITY UPDATE: internal-sftp ignores more than 9 commandline args", " - debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline", " arguments to the internal-sftp server, in session.c.", " - CVE-2026-59997", " * SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour", " - debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding", " GSSAPIStrictAcceptorCheck in in sshd_config.5.", " - CVE-2026-59998", " * SECURITY UPDATE: DisableForwarding=yes not taking proper precedence", " - debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes", " didn't override PermitTunnel=yes in serverloop.c.", " - CVE-2026-59999", " * SECURITY UPDATE: DoS via MaxAuthTries mishandling", " - debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462", " (GSSAPIAuthentication) compliance in auth2-gss.c.", " - debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in", " auth2-gss.c.", " - CVE-2026-60000", " * SECURITY UPDATE: minimum authentication delay not always honoured", " - debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and", " keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.", " - CVE-2026-60001", " * SECURITY UPDATE: Use-after-free during a key re-exchange", " - debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime", " of several bits of client in ssh.c, sshconnect.c, sshconnect.h,", " sshconnect2.c.", " - CVE-2026-60002", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.16", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 09 Jul 2026 14:38:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.15", "version": "1:8.9p1-3ubuntu0.15" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.16", "version": "1:8.9p1-3ubuntu0.16" }, "cves": [ { "cve": "CVE-2026-59995", "url": "https://ubuntu.com/security/CVE-2026-59995", "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59996", "url": "https://ubuntu.com/security/CVE-2026-59996", "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59997", "url": "https://ubuntu.com/security/CVE-2026-59997", "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59998", "url": "https://ubuntu.com/security/CVE-2026-59998", "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59999", "url": "https://ubuntu.com/security/CVE-2026-59999", "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60000", "url": "https://ubuntu.com/security/CVE-2026-60000", "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60001", "url": "https://ubuntu.com/security/CVE-2026-60001", "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60002", "url": "https://ubuntu.com/security/CVE-2026-60002", "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59995", "url": "https://ubuntu.com/security/CVE-2026-59995", "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59996", "url": "https://ubuntu.com/security/CVE-2026-59996", "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59997", "url": "https://ubuntu.com/security/CVE-2026-59997", "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59998", "url": "https://ubuntu.com/security/CVE-2026-59998", "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59999", "url": "https://ubuntu.com/security/CVE-2026-59999", "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60000", "url": "https://ubuntu.com/security/CVE-2026-60000", "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60001", "url": "https://ubuntu.com/security/CVE-2026-60001", "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60002", "url": "https://ubuntu.com/security/CVE-2026-60002", "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp downloaded files location issue", " - debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-", " controlled path when performing in sftp.c.", " - CVE-2026-59995", " * SECURITY UPDATE: scp parent directory issue", " - debian/patches/CVE-2026-59996.patch: upstream: resist that return \"..\" via", " remote glob during in scp.c.", " - CVE-2026-59996", " * SECURITY UPDATE: internal-sftp ignores more than 9 commandline args", " - debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline", " arguments to the internal-sftp server, in session.c.", " - CVE-2026-59997", " * SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour", " - debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding", " GSSAPIStrictAcceptorCheck in in sshd_config.5.", " - CVE-2026-59998", " * SECURITY UPDATE: DisableForwarding=yes not taking proper precedence", " - debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes", " didn't override PermitTunnel=yes in serverloop.c.", " - CVE-2026-59999", " * SECURITY UPDATE: DoS via MaxAuthTries mishandling", " - debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462", " (GSSAPIAuthentication) compliance in auth2-gss.c.", " - debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in", " auth2-gss.c.", " - CVE-2026-60000", " * SECURITY UPDATE: minimum authentication delay not always honoured", " - debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and", " keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.", " - CVE-2026-60001", " * SECURITY UPDATE: Use-after-free during a key re-exchange", " - debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime", " of several bits of client in ssh.c, sshconnect.c, sshconnect.h,", " sshconnect2.c.", " - CVE-2026-60002", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.16", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 09 Jul 2026 14:38:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.15", "version": "1:8.9p1-3ubuntu0.15" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.16", "version": "1:8.9p1-3ubuntu0.16" }, "cves": [ { "cve": "CVE-2026-59995", "url": "https://ubuntu.com/security/CVE-2026-59995", "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59996", "url": "https://ubuntu.com/security/CVE-2026-59996", "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59997", "url": "https://ubuntu.com/security/CVE-2026-59997", "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59998", "url": "https://ubuntu.com/security/CVE-2026-59998", "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59999", "url": "https://ubuntu.com/security/CVE-2026-59999", "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60000", "url": "https://ubuntu.com/security/CVE-2026-60000", "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60001", "url": "https://ubuntu.com/security/CVE-2026-60001", "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60002", "url": "https://ubuntu.com/security/CVE-2026-60002", "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59995", "url": "https://ubuntu.com/security/CVE-2026-59995", "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59996", "url": "https://ubuntu.com/security/CVE-2026-59996", "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59997", "url": "https://ubuntu.com/security/CVE-2026-59997", "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59998", "url": "https://ubuntu.com/security/CVE-2026-59998", "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-59999", "url": "https://ubuntu.com/security/CVE-2026-59999", "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60000", "url": "https://ubuntu.com/security/CVE-2026-60000", "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60001", "url": "https://ubuntu.com/security/CVE-2026-60001", "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" }, { "cve": "CVE-2026-60002", "url": "https://ubuntu.com/security/CVE-2026-60002", "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)", "cve_priority": "medium", "cve_public_date": "2026-07-08 01:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp downloaded files location issue", " - debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-", " controlled path when performing in sftp.c.", " - CVE-2026-59995", " * SECURITY UPDATE: scp parent directory issue", " - debian/patches/CVE-2026-59996.patch: upstream: resist that return \"..\" via", " remote glob during in scp.c.", " - CVE-2026-59996", " * SECURITY UPDATE: internal-sftp ignores more than 9 commandline args", " - debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline", " arguments to the internal-sftp server, in session.c.", " - CVE-2026-59997", " * SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour", " - debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding", " GSSAPIStrictAcceptorCheck in in sshd_config.5.", " - CVE-2026-59998", " * SECURITY UPDATE: DisableForwarding=yes not taking proper precedence", " - debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes", " didn't override PermitTunnel=yes in serverloop.c.", " - CVE-2026-59999", " * SECURITY UPDATE: DoS via MaxAuthTries mishandling", " - debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462", " (GSSAPIAuthentication) compliance in auth2-gss.c.", " - debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in", " auth2-gss.c.", " - CVE-2026-60000", " * SECURITY UPDATE: minimum authentication delay not always honoured", " - debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and", " keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.", " - CVE-2026-60001", " * SECURITY UPDATE: Use-after-free during a key re-exchange", " - debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime", " of several bits of client in ssh.c, sshconnect.c, sshconnect.h,", " sshconnect2.c.", " - CVE-2026-60002", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.16", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 09 Jul 2026 14:38:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-httplib2", "from_version": { "source_package_name": "python-httplib2", "source_package_version": "0.20.2-2", "version": "0.20.2-2" }, "to_version": { "source_package_name": "python-httplib2", "source_package_version": "0.20.2-2ubuntu0.1", "version": "0.20.2-2ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-59939", "url": "https://ubuntu.com/security/CVE-2026-59939", "cve_description": "httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.", "cve_priority": "medium", "cve_public_date": "2026-07-08 20:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59939", "url": "https://ubuntu.com/security/CVE-2026-59939", "cve_description": "httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.", "cve_priority": "medium", "cve_public_date": "2026-07-08 20:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: unbounded decompression of HTTP response bodies", " - debian/patches/CVE-2026-59939.patch: decompression limited by size and", " ratio; require python 3.8+ in README.md, python3/httplib2/__init__.py,", " python3/httplib2/decode.py, setup.cfg, tests/__init__.py,", " tests/test_encoding.py.", " - CVE-2026-59939", "" ], "package": "python-httplib2", "version": "0.20.2-2ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 10 Jul 2026 08:18:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-idna", "from_version": { "source_package_name": "python-idna", "source_package_version": "3.3-1ubuntu0.1", "version": "3.3-1ubuntu0.1" }, "to_version": { "source_package_name": "python-idna", "source_package_version": "3.3-1ubuntu0.2", "version": "3.3-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-45409", "url": "https://ubuntu.com/security/CVE-2026-45409", "cve_description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.", "cve_priority": "medium", "cve_public_date": "2026-06-05 23:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-45409", "url": "https://ubuntu.com/security/CVE-2026-45409", "cve_description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.", "cve_priority": "medium", "cve_public_date": "2026-06-05 23:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: DoS via specially crafted inputs to idna.encode()", " - debian/patches/CVE-2026-45409-1.patch: Reject oversized inputs up-front in", " idna/core.py, tests/test_idna.py.", " - debian/patches/CVE-2026-45409-2.patch: Use valid_string_length() for early", " oversized-input check in idna/core.py.", " - debian/patches/CVE-2026-45409-3.patch: Enforce early length limits in", " check_label in idna/core.py, tests/test_idna.py.", " - CVE-2026-45409", "" ], "package": "python-idna", "version": "3.3-1ubuntu0.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 14 Jul 2026 13:21:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.75.2+ubuntu22.04", "version": "2.75.2+ubuntu22.04" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.76+ubuntu22.04.1", "version": "2.76+ubuntu22.04.1" }, "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-8933", "url": "https://ubuntu.com/security/CVE-2026-8933", "cve_description": "A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-15226", "url": "https://ubuntu.com/security/CVE-2026-15226", "cve_description": "A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154498, 2147606, 2139213, 2125344, 2152908, 1966067, 2110368, 2110368, 2144666, 2146337, 2147207, 2143882, 2143882, 2142130, 2137543, 2142655, 2139664, 2139065, 2002697, 2141461, 2138268 ], "changes": [ { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-8933", "url": "https://ubuntu.com/security/CVE-2026-8933", "cve_description": "A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-15226", "url": "https://ubuntu.com/security/CVE-2026-15226", "cve_description": "A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: information disclosure", " - interfaces/apparmor/template.go: don't grant access to systemd", " userdb API sockets.", " - CVE-2024-5300", " * SECURITY UPDATE: Privilege escalation", " - cmd/snap-confine: harden construction of bootstrap rootfs", " - CVE-2026-8933", " * SECURITY UPDATE: Privilege abuse", " - interfaces/snap-confine: harden seccomp template", " - CVE-2026-15226", "" ], "package": "snapd", "version": "2.76+ubuntu22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Fri, 10 Jul 2026 13:48:41 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2154498", " - assertions: add helper for validating integrity data", " - assertions: drop incorrect/non-standard Ed25519 support", " - confdb: allow only API admin read access to confdb secrets", " - confdb: block concurrent confdb accesses", " - confdb: block concurrent snapctl accesses to configuration", " database", " - confdb: check for ephemeral data when missing save-view hook on", " commit", " - confdb: ignore not-found errors in confdb-schema refreshes", " - confdb: support --wait-for timeouts when accessing confdb", " - core-initrd: add group referenced in udev rules", " - core-initrd: add libbpf dependency to initramfs", " - core-initrd: add missing libbpf dependency in 24.04 packaging", " - core-initrd: ensure audio is a system group", " - core-initrd: fix /boot/uboot mount with u-boot env in dedicated", " partition", " - core-initrd: increase mount burst from 5 to 128 for faster boot", " - core-initrd: sync partition udev rules with the ones in core-base", " - core-initrd: sync with latest upload to snappy-dev PPA", " - core-initrd: synchronize changelogs with latest PPA upload", " - core-initrd: update changelog with latest PPA upload", " - core-initrd: add nfnetlink module to fix nf netlink", " socket speed regression (Ubuntu Core only)", " - cross-distro: allow snapd to manipulate systemd unit files in", " SELinux policy", " - cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch", " - desktop: fix common ID selection with multiple desktop plugs", " - FDE: allow user mode on core in secboot TPM handling", " - FDE: bump go-efilib dependency", " - FDE: bump secboot to rev cdcb64992e54 for FDE fixes", " - FDE: deprecate check-pin/passphrase API endpoints", " - LP: #2147606 FDE: give inactive state on classic", " - FDE: improve tracing for OP-TEE probing", " - FDE: move auto-repair logic to overlord/fdestate and provide state", " - FDE: update secboot for TPM/FDE bug fixes including Intel HAP and", " recovery key parsing", " - FDE: use any primary key matching digest when adding a keyslot", " - FDE: use ignore action for preinstall check in VM", " - interfaces: bluez | drop explicit deny send_destination in D-Bus", " configuration", " - interfaces: conditionally deny /proc/self/mountinfo to suppress Go", " 1.25+ denials", " - interfaces: custom-device | fix for-device validation panic on", " non-string value", " - interfaces: disallow auto-connect to parallel installs", " - interfaces: docker | make plug implicit on classic systems", " - interfaces: ignore errors in disconnect hooks during explicit snap", " disconnect", " - interfaces: mediatek-accel | add plug interface base declaration", " - interfaces: microceph-support | suppress noisy sudo denial audit", " logs", " - interfaces: podman | add new interface for podman socket access", " - interfaces: pulseaudio | fix security tag syntax inconsistency", " - interfaces: raw-usb | allow USB device enumeration on Fairphone 5", " with NexDock", " - interfaces: restore auto-connections on failed refresh undo", " - interfaces: bool-file | support deep SoC sysfs paths", " for LED brightness", " - LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17", " compliant", " - packaging: add cross-distro build script and instructions", " - packaging: add openSUSE 16.0 spread support", " - packaging: Debian build improvements", " - packaging: default openSUSE to /var/lib/snapd/snap and sync from", " downstream", " - packaging: fix Launchpad FIPS build detection for snapd-fips job", " - packaging: refactor and clean up snapd.mk, standardize test-data", " directories", " - packaging: switch to golang-github-chai2010-gettext-go-dev", " - packaging: update bundled AppArmor 4.1.7 (snapd snap only)", " - prompting: escape paths in prompt constraints", " - prompting: improve API error handling and validation", " - prompting: improve error message when no handler service is", " present", " - prompting: re-enable the prompting notice backend", " - prompting: respond with full user-allowed permission set", " - prompting: validate permissions while unmarshalling", " - remote device management: implement dispatch-mgmt-messages task", " with sequencing support", " - LP: #2125344 snap: avoid empty channel forwarding message", " - snap: clarify snap install help text for --classic", " and --devmode", " - LP: #2152908 snap: print complex attributes in snap interface", " --attrs output", " - snap: add run-inhibit hint and inhibit info when a snap is", " disabled", " - snap: allow removing a snap and its base at the same time", " - snap: display detailed component information in snap info", " - snap: extend AlreadyInstalledError to multiple snaps and", " components", " - snap: extend set-quota command options description with accepted", " value formats", " - snap: implement snap delta command for computing snap deltas", " - snap: improve consistency for snap install when some snaps are", " already installed", " - snap: show hint in snap list that a snap has components", " - snap-confine: allow inheriting unix sockets from snaps", " - snap-confine: allow linking to libm in AppArmor profile", " - snap-confine: fix out-of-bounds read in mountinfo parser for", " partial escape sequences", " - snap-confine: harden bpffs mount with nosuid, nodev, noexec flags", " - snap-confine: remove experimental persistent per-user mount", " namespace feature", " - snap-confine: set FD_CLOEXEC on file descriptors returned by BPF", " helpers", " - snap-confine: support transparent_hugepage in AppArmor profile", " - snap-confine: use strchr after NUL-terminating in infofile parser", " - snap-update-ns: switch to a multi-pass process for constructing", " and updating mount namespaces", " - RemoveMountUnitFile now unmounts even if mount unit file is", " missing", " - Add explicit mount phase during single-reboot refresh to fix undo", " of kernel refreshes", " - Add security audit logging subsystem", " - Add base prioritized AppArmmor snippets for strictly confined or", " jailed snaps", " - Allow openshell snap to use experimental daemon-scope: user", " - Allow configuring mount unit options based on filesystem type", " - Allow equals signs in uevent values in netlink parser", " - Also bind-mount directories modified by kmod backend during", " preseed", " - Clean up potentially corrupted files during snap download undo", " - Complete the bootloader environment implementation", " - Copy integrity data files during snap install", " - Create hook for seed refresh mode", " - Create removal tasks for old seed-refresh seeds", " - Dispatch systemctl commands asynchronously when calling Stop()", " - Ensure /tmp/.X11-unix created inside mount namespace has correct", " permissions", " - Ensure exclusive changes conflict with refresh/revert", " - Ensure existing snap confinement flags are not dropped when", " installing or removing components", " - Export ubuntu-boot-state filename constant from bootloader package", " - Fix duplicate removal of apps under $SNAP_MOUNT_DIR/bin", " - Fix integration between prerequisites task and seed-refresh mode", " - Fix split-refresh overwriting provided lane", " - Fix use of umask in GetListener for socket activation", " - Ignore net.ErrClosed during daemon shutdown", " - Implement ResolveValidationSetsEnforcementError in terms of one", " call", " - Improve snapctl install consistency when components are already", " installed", " - Inject seed creation tasks into snap refresh flow", " - Introduce system options for custom certificates on Ubuntu Core", " - Keep idle services with activation units stopped on reload", " - List snap components in snap-debug-info via debug-tools", " - Look at gadget.yaml instead of marker file to determine ubootpart", " usage", " - LP: #1966067 Skip redundant xdg-settings confirmation prompt when", " setting is already correct", " - LP: #2110368 Fix component installation for private snaps via", " snapctl", " - LP: #2110368 Fix download of private snap components by setting", " UserID", " - LP: #2144666 Fix mount namespace updates with synthetic bind", " mounts on same target paths", " - LP: #2146337 Improve handling of failed downloads and retain", " partial files for resume", " - LP: #2147207 Fix snap enable/disable cycle forgetting components", " - Make run-inhibit hint for kill-snap-apps task based on kill reason", " - Merge content-provider prerequisite updates into seed-refresh", " - Move SortServices into Backend.StartServices", " - Move state to client change conversion to ctlcmd package", " - Omit misleading \"try to refresh snapd\" suggestion for ISA-related", " errors", " - Only create link-component tasks when needed during refresh to", " existing revision", " - Reconfigure piboot bootloader on gadget refreshes to preserve", " os_prefix", " - Reduce the number of AppArmor profile regenerations during snap", " operations", " - Refactor seed-refresh ownership to devicestate", " - Regenerate certificate database on remodels", " - Remove obsolete FIXME comment in VersionCompare", " - Remove unused GenerateDmVerityData helper from snap/integrity", " - Rename and document error type for ISA assumes flags", " - Restart snapd from daemon.Stop to improve restart reliability", " - Restart stopped services on error in stopSnapServices for", " transactionality", " - Simplify certificate-db updates on model-base refresh/installs", " - Support racing Loop and Stop correctly in overlord", " - Support sending file descriptors to systemd via sd_notify", " - Unroll CPU-heavy recursive function in snap state handlers", " - Update seccomp syscalls list for kernel 7.1.0", " - Use change ID to prevent nested seed-refresh spawned by", " prerequisites", " - Validate content interface plug target directories exist for", " core26+ snaps", " - Validate layout paths exist in snap tree for snaps using bare or", " core26+", "" ], "package": "snapd", "version": "2.76+ubuntu22.04", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2154498, 2147606, 2139213, 2125344, 2152908, 1966067, 2110368, 2110368, 2144666, 2146337, 2147207 ], "author": "Ernest Lotter ", "date": "Thu, 28 May 2026 20:00:16 +0200" }, { "cves": [ { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2143882", " - FDE: limit number of boot check log entries", " - Allow a logged in user to refresh private snaps during a refresh", " with multiple snaps", " - Use precise prune pattern for tmpfiles (CVE-2026-3888)", "" ], "package": "snapd", "version": "2.75.1", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2143882 ], "author": "Katie May ", "date": "Wed, 18 Mar 2026 09:59:01 +0100" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2143882", " - FDE: run early boot check only once per boot", " - FDE: update secboot to revision 77bc2457cc76", " - FDE: add degraded state for status API", " - FDE: prevent resealing tasks from running together", " - FDE: enable using keyslot tokens to store protected keys for UC26+", " - FDE: early commit kcmdline config transaction in update-gadget-", " cmdline to mitigate possible race condition", " - FDE: ensure extra snapd kcmdline fragments are applied", " - FDE: remove old secboot activation API calls", " - LP: #2142130 update apparmor parser to 4.1.7", " - LP: #2137543 disable translations in formatted output for snapctl", " services", " - LP: #2142655 improve snap size reporting precision in snap info", " output", " - LP: #2139664 snap-confine: remove race condition triggered by hat", " profile", " - LP: #2139065 skip 70-snap.*.rules when building dracut initramfs", " - LP: #2002697 error early on removal without purge if home is in", " NFS mount", " - LP: #2141461 Intefaces: allow snap-update-ns to read", " /proc/pid/auxv", " - LP: #2138268 Interfaces: kerberos-tickets| new interface allow", " access to kerberos tickets stored in /tmp", " - Interfaces: block-devices| allow Xen block devices", " - Interfaces: u2f-devices| add Tokey 3 FIDO", " - Interfaces: devlxd| new interface allowing acccess to LXD devlxd", " socket and APIs", " - Interfaces: browser-support| allow reading pressure stall info", " information", " - Interfaces: network-setup-control| allow additional netplan files", " access", " - Interfaces: desktop| allow access kvantum, lxqt, and gtk4", " configuration files", " - Interfaces: system-observe| allow fdinfo access for GPU monitoring", " - Interfaces: ubuntu-pro-control| allow access to Ubuntu Advantage", " client configuration", " - Prompting: add API endpoint to ask whether application should have", " access", " - Prompting: add support for audio-record prompting via API endpoint", " - Prompting: store snap name instead of apparmor label in requests", " - Prompting: respond with 503 to API requests when prompting", " subsystem is shutting down", " - Prompting: generalize prompting subsystem to support requests from", " outside AppArmor", " - Confdb: unset data for missing paths in set request", " - Confdb: return 400 for API requests with missing filter", " constraints", " - Confdb: return 400 for API requests with unmatched filter", " constraints", " - Confdb: support typed constraints in confdb filtering", " - Confdb: fixed unmarshalling transaction with placeholder path in", " deltas", " - Confdb: refresh confdb-schema assertions during manual refresh", " - Remote device management (experimental): add skeleton device", " management manager", " - Remote device management (experimental): add message exchange loop", " - Components: add snap component command, include component summary", " in snap info output", " - Components: enforce validation sets when installing components", " - Configuration: add system.motd configuration option to customize", " message of the day (motd)", " - packaging: remove dependencies libbrotli1, libfreetype6, and", " libpng16-16 from snap", " - snap-bootstrap: use libblkid for disk information to speed up boot", " - snap-confine: improve data handling error", " - snap-confine: use ld cache from the app base for core26+", " - snap: add riscv ISA detection for snaps", " - squashfs: reduce memory footprint of single file extraction", " - Add experimental snap delta format", " - Enable early download of seed snaps during refresh", " - Enable parallel downloads of essential snaps during refresh", " - Disallow removing components required by validation sets", " - Make snap prepare-image fail on --validation=ignore if model has", " enforced validation-sets", " - Fix correctly handling interrupted snap downloads", " - Fix handling of store throttling for refresh-app-awareness", " monitored snaps", " - Stop removed \"endure\" services on refresh", " - Install by default from the initramfs for UC26+, removing the need", " for a reboot after installation", " - Keep minidebuginfo in snapd snap", " - Make snap-specific systemd cgroup mandatory for snaps using core26", " and later, improve messaging for failure scenarios", " - Preserve stale connections of broken snaps", " - Remove enforce-validation-sets need for network", " - Opportunistic discarding of mount namespace when updating slot", " providers", " - Support for delaying updates of snap mount namespaces when", " refreshing slot providers", " - Use application CommonID as default source for desktop ID", "" ], "package": "snapd", "version": "2.75", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 2143882, 2142130, 2137543, 2142655, 2139664, 2139065, 2002697, 2141461, 2138268 ], "author": "Katie May ", "date": "Mon, 09 Mar 2026 17:10:13 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "tar", "from_version": { "source_package_name": "tar", "source_package_version": "1.34+dfsg-1ubuntu0.1.22.04.4", "version": "1.34+dfsg-1ubuntu0.1.22.04.4" }, "to_version": { "source_package_name": "tar", "source_package_version": "1.34+dfsg-1ubuntu0.1.22.04.5", "version": "1.34+dfsg-1ubuntu0.1.22.04.5" }, "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2160650 ], "changes": [ { "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Extract files issue", " - debian/patches/CVE-2026-5704-*.patch: address a regression", " that makes valid files not extract in src/list.c,", " tests/Makefile.am, tests/extrac32.at, tests/extrac34.at,", " test/testsuite.at, src/extract.c, tests/extract23,", " tests/extrac30.at (LP: #2160650).", "" ], "package": "tar", "version": "1.34+dfsg-1ubuntu0.1.22.04.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2160650 ], "author": "Leonidas Da Silva Barbosa ", "date": "Wed, 15 Jul 2026 11:39:01 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-advantage-tools", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04", "version": "37.2ubuntu~22.04" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04.1", "version": "37.2ubuntu~22.04.1" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc//cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc//cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:36:19 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-pro-client", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04", "version": "37.2ubuntu~22.04" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04.1", "version": "37.2ubuntu~22.04.1" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc//cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc//cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:36:19 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-pro-client-l10n", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04", "version": "37.2ubuntu~22.04" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~22.04.1", "version": "37.2ubuntu~22.04.1" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc//cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc//cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-17 14:00:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-17 14:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:36:19 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.33", "version": "2:8.2.3995-1ubuntu2.33" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Command execution in PHP omni-completion.", " - debian/patches/CVE-2026-59856.patch: Quote the class name before", " inserting it into the search() in runtime/autoload/phpcomplete.vim", " - CVE-2026-59856", " * SECURITY UPDATE: Stack out-of-bounds write in spell_soundfold_sal().", " - debian/patches/CVE-2026-59857.patch: Bound the single-byte SAL result", " writes in src/spell.c", " - CVE-2026-59857", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-59858.patch: Escape the type field before", " inserting it into pattern in runtime/autoload/ccomplete.vim", " - CVE-2026-59858", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.34", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 13 Jul 2026 13:08:21 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-common", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.33", "version": "2:8.2.3995-1ubuntu2.33" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Command execution in PHP omni-completion.", " - debian/patches/CVE-2026-59856.patch: Quote the class name before", " inserting it into the search() in runtime/autoload/phpcomplete.vim", " - CVE-2026-59856", " * SECURITY UPDATE: Stack out-of-bounds write in spell_soundfold_sal().", " - debian/patches/CVE-2026-59857.patch: Bound the single-byte SAL result", " writes in src/spell.c", " - CVE-2026-59857", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-59858.patch: Escape the type field before", " inserting it into pattern in runtime/autoload/ccomplete.vim", " - CVE-2026-59858", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.34", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 13 Jul 2026 13:08:21 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-runtime", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.33", "version": "2:8.2.3995-1ubuntu2.33" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Command execution in PHP omni-completion.", " - debian/patches/CVE-2026-59856.patch: Quote the class name before", " inserting it into the search() in runtime/autoload/phpcomplete.vim", " - CVE-2026-59856", " * SECURITY UPDATE: Stack out-of-bounds write in spell_soundfold_sal().", " - debian/patches/CVE-2026-59857.patch: Bound the single-byte SAL result", " writes in src/spell.c", " - CVE-2026-59857", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-59858.patch: Escape the type field before", " inserting it into pattern in runtime/autoload/ccomplete.vim", " - CVE-2026-59858", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.34", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 13 Jul 2026 13:08:21 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "vim-tiny", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.33", "version": "2:8.2.3995-1ubuntu2.33" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Command execution in PHP omni-completion.", " - debian/patches/CVE-2026-59856.patch: Quote the class name before", " inserting it into the search() in runtime/autoload/phpcomplete.vim", " - CVE-2026-59856", " * SECURITY UPDATE: Stack out-of-bounds write in spell_soundfold_sal().", " - debian/patches/CVE-2026-59857.patch: Bound the single-byte SAL result", " writes in src/spell.c", " - CVE-2026-59857", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-59858.patch: Escape the type field before", " inserting it into pattern in runtime/autoload/ccomplete.vim", " - CVE-2026-59858", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.34", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 13 Jul 2026 13:08:21 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "wget", "from_version": { "source_package_name": "wget", "source_package_version": "1.21.2-2ubuntu1.1", "version": "1.21.2-2ubuntu1.1" }, "to_version": { "source_package_name": "wget", "source_package_version": "1.21.2-2ubuntu1.4", "version": "1.21.2-2ubuntu1.4" }, "cves": [ { "cve": "CVE-2026-15146", "url": "https://ubuntu.com/security/CVE-2026-15146", "cve_description": "GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.", "cve_priority": "medium", "cve_public_date": "2026-07-10 19:17:00 UTC" }, { "cve": "CVE-2026-58469", "url": "https://ubuntu.com/security/CVE-2026-58469", "cve_description": "GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" }, { "cve": "CVE-2026-58470", "url": "https://ubuntu.com/security/CVE-2026-58470", "cve_description": "GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" }, { "cve": "CVE-2026-58471", "url": "https://ubuntu.com/security/CVE-2026-58471", "cve_description": "GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" }, { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15146", "url": "https://ubuntu.com/security/CVE-2026-15146", "cve_description": "GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.", "cve_priority": "medium", "cve_public_date": "2026-07-10 19:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: SSRF forgery in FTP.", " - debian/patches/CVE-2026-15146.patch: Validate PASV/LPSV response address", " against control connection peer in src/ftp-basic.c", " - CVE-2026-15146", "" ], "package": "wget", "version": "1.21.2-2ubuntu1.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 16 Jul 2026 10:38:47 -0600" }, { "cves": [ { "cve": "CVE-2026-58469", "url": "https://ubuntu.com/security/CVE-2026-58469", "cve_description": "GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" }, { "cve": "CVE-2026-58470", "url": "https://ubuntu.com/security/CVE-2026-58470", "cve_description": "GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" }, { "cve": "CVE-2026-58471", "url": "https://ubuntu.com/security/CVE-2026-58471", "cve_description": "GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" }, { "cve": "CVE-2026-58472", "url": "https://ubuntu.com/security/CVE-2026-58472", "cve_description": "GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.", "cve_priority": "medium", "cve_public_date": "2026-07-07 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in metalink.", " - debian/patches/CVE-2026-58469.patch: Fix buffer overflow in", " src/metalink.c", " - CVE-2026-58469", " * SECURITY UPDATE: Integer overflow in http", " - debian/patches/CVE-2026-58470.patch: Fix integer overflow in src/http.c", " - CVE-2026-58470", " * SECURITY UPDATE: Buffer overflow in convert_fname.", " - debian/patches/CVE-2026-58471.patch: Fix buffer overflow in src/url.c", " - CVE-2026-58471", " * SECURITY UPDATE: Integer and buffer overflow in html_quote_string.", " - debian/patches/CVE-2026-58472.patch: Fix integer+buffer overflow in", " src/convert.c", " - CVE-2026-58472", "" ], "package": "wget", "version": "1.21.2-2ubuntu1.3", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Fri, 10 Jul 2026 16:04:53 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "xxd", "from_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.33", "version": "2:8.2.3995-1ubuntu2.33" }, "to_version": { "source_package_name": "vim", "source_package_version": "2:8.2.3995-1ubuntu2.34", "version": "2:8.2.3995-1ubuntu2.34" }, "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59856", "url": "https://ubuntu.com/security/CVE-2026-59856", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59857", "url": "https://ubuntu.com/security/CVE-2026-59857", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" }, { "cve": "CVE-2026-59858", "url": "https://ubuntu.com/security/CVE-2026-59858", "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.", "cve_priority": "medium", "cve_public_date": "2026-07-09 23:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Command execution in PHP omni-completion.", " - debian/patches/CVE-2026-59856.patch: Quote the class name before", " inserting it into the search() in runtime/autoload/phpcomplete.vim", " - CVE-2026-59856", " * SECURITY UPDATE: Stack out-of-bounds write in spell_soundfold_sal().", " - debian/patches/CVE-2026-59857.patch: Bound the single-byte SAL result", " writes in src/spell.c", " - CVE-2026-59857", " * SECURITY UPDATE: Arbitrary command execution during C omni-completion.", " - debian/patches/CVE-2026-59858.patch: Escape the type field before", " inserting it into pattern in runtime/autoload/ccomplete.vim", " - CVE-2026-59858", "" ], "package": "vim", "version": "2:8.2.3995-1ubuntu2.34", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 13 Jul 2026 13:08:21 -0600" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20260711 to 20260722", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260711", "to_serial": "20260722", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }