{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "dbus-broker", "linux-headers-7.1.0-5-generic", "linux-image-7.1.0-5-generic", "linux-main-modules-zfs-7.1.0-5-generic", "linux-modules-7.1.0-5-generic", "linux-riscv-headers-7.1.0-5", "linux-riscv-tools-7.1.0-5", "linux-tools-7.1.0-5-generic" ], "removed": [ "libflashrom1:riscv64", "libftdi1-2:riscv64", "libjcat1:riscv64", "libjson-glib-1.0-0:riscv64", "libjson-glib-1.0-common", "librtmp1:riscv64", "linux-headers-7.0.0-14-generic", "linux-image-7.0.0-14-generic", "linux-main-modules-zfs-7.0.0-14-generic", "linux-modules-7.0.0-14-generic", "linux-riscv-headers-7.0.0-14", "linux-riscv-tools-7.0.0-14", "linux-tools-7.0.0-14-generic" ], "diff": [ "apport", "apport-core-dump-handler", "appstream", "base-files", "bolt", "ca-certificates", "cloud-guest-utils", "cloud-init", "cloud-init-base", "console-setup", "console-setup-linux", "coreutils", "coreutils-from-uutils", "curl", "dbus", "dbus-bin", "dbus-daemon", "dbus-session-bus-common", "dbus-system-bus-common", "dbus-user-session", "dhcpcd-base", "dirmngr", "distro-info-data", "dmidecode", "e2fsprogs", "efibootmgr", "exfatprogs", "fwupd", "gir1.2-packagekitglib-1.0", "gnupg", "gnupg-l10n", "gnupg-utils", "gpg", "gpg-agent", "gpg-wks-client", "gpgconf", "gpgsm", "gpgv", "grub-efi-riscv64", "grub-efi-riscv64-bin", "grub-efi-riscv64-unsigned", "grub2-common", "htop", "ieee-data", "keyboard-configuration", "libappstream5:riscv64", "libattr1:riscv64", "libblockdev-crypto3:riscv64", "libblockdev-fs3:riscv64", "libblockdev-loop3:riscv64", "libblockdev-mdraid3:riscv64", "libblockdev-nvme3:riscv64", "libblockdev-part3:riscv64", "libblockdev-smart3:riscv64", "libblockdev-swap3:riscv64", "libblockdev-utils3:riscv64", "libblockdev3:riscv64", "libbytesize-common", "libbytesize1:riscv64", "libcom-err2:riscv64", "libcurl3t64-gnutls:riscv64", "libcurl4t64:riscv64", "libdbus-1-3:riscv64", "libext2fs2t64:riscv64", "libfastjson4:riscv64", "libfwupd3:riscv64", "libgpg-error-l10n", "libgpg-error0:riscv64", "libgpgme45:riscv64", "libgstreamer1.0-0:riscv64", "libldap-common", "libldap2:riscv64", "liblocale-gettext-perl", "libnewt0.52:riscv64", "libnghttp2-14:riscv64", "libnspr4:riscv64", "libp11-kit0:riscv64", "libpackagekit-glib2-18:riscv64", "libperl5.40:riscv64", "libpsl5t64:riscv64", "libsemanage-common", "libsemanage2:riscv64", "libsepol2:riscv64", "libss2:riscv64", "libssh2-1t64:riscv64", "libssl3t64:riscv64", "libudisks2-0:riscv64", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-virtual", "logsave", "motd-news-config", "nano", "openssh-client", "openssh-server", "openssh-sftp-server", "openssl", "openssl-provider-legacy", "packagekit", "perl", "perl-base", "perl-modules-5.40", "powermgmt-base", "publicsuffix", "python3-apport", "python3-certifi", "python3-debian", "python3-distro", "python3-hamcrest", "python3-httplib2", "python3-jmespath", "python3-jsonschema-specifications", "python3-oauthlib", "python3-problem-report", "python3-service-identity", "python3-typeguard", "python3-update-manager", "python3-urllib3", "python3-wadllib", "python3-zope.interface", "rsyslog", "snapd", "sysvinit-utils", "trace-cmd", "tzdata", "ubuntu-kernel-accessories", "ubuntu-minimal", "ubuntu-server", "ubuntu-standard", "ucf", "udisks2", "update-manager-core", "update-notifier-common", "usb.ids", "whiptail", "xkb-data", "zlib1g:riscv64" ] } }, "diff": { "deb": [ { "name": "apport", "from_version": { "source_package_name": "apport", "source_package_version": "2.34.0-0ubuntu2", "version": "2.34.0-0ubuntu2" }, "to_version": { "source_package_name": "apport", "source_package_version": "2.35.0-0ubuntu1", "version": "2.35.0-0ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", " - Fix support for zstd compressed CoreDump (LP: #2148656)", " - apt_dpkg:", " + support using configured proxies (LP: #2116119)", " + exclude {usr/,}lib/modules and more from Contents-*.gz cache", " to reduce required memory for apport-retrace (LP: #2073787)", " + fix mapping primary ports.ubuntu.com to archive.ubuntu.com", " (LP: #2150427)", " + fix GDB command for amd64 sandbox on non-amd64 (LP: #2150427)", " - problem_report:", " + enforce some keys to always have str values in load() (LP: #2146806)", " + avoid double .txt file extension (LP: #2149892)", " - test:", " + use pwd, ls, and true from GNU coreutils in apport-valgrind tests", " (LP: #2158973)", " + relax check for Package field (LP: #2149909)", " + fix running tests as non-root system user (LP: #2153134)", " * test: replace SKIP_ONLINE_TESTS by requires_internet marker", "" ], "package": "apport", "version": "2.35.0-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "author": "Benjamin Drung ", "date": "Thu, 02 Jul 2026 21:51:47 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "apport-core-dump-handler", "from_version": { "source_package_name": "apport", "source_package_version": "2.34.0-0ubuntu2", "version": "2.34.0-0ubuntu2" }, "to_version": { "source_package_name": "apport", "source_package_version": "2.35.0-0ubuntu1", "version": "2.35.0-0ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", " - Fix support for zstd compressed CoreDump (LP: #2148656)", " - apt_dpkg:", " + support using configured proxies (LP: #2116119)", " + exclude {usr/,}lib/modules and more from Contents-*.gz cache", " to reduce required memory for apport-retrace (LP: #2073787)", " + fix mapping primary ports.ubuntu.com to archive.ubuntu.com", " (LP: #2150427)", " + fix GDB command for amd64 sandbox on non-amd64 (LP: #2150427)", " - problem_report:", " + enforce some keys to always have str values in load() (LP: #2146806)", " + avoid double .txt file extension (LP: #2149892)", " - test:", " + use pwd, ls, and true from GNU coreutils in apport-valgrind tests", " (LP: #2158973)", " + relax check for Package field (LP: #2149909)", " + fix running tests as non-root system user (LP: #2153134)", " * test: replace SKIP_ONLINE_TESTS by requires_internet marker", "" ], "package": "apport", "version": "2.35.0-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "author": "Benjamin Drung ", "date": "Thu, 02 Jul 2026 21:51:47 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "appstream", "from_version": { "source_package_name": "appstream", "source_package_version": "1.1.2-1", "version": "1.1.2-1" }, "to_version": { "source_package_name": "appstream", "source_package_version": "1.1.3-1", "version": "1.1.3-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version: 1.1.3", " * Bump standards version: No changes needed", "" ], "package": "appstream", "version": "1.1.3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klumpp ", "date": "Thu, 18 Jun 2026 20:04:56 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "base-files", "from_version": { "source_package_name": "base-files", "source_package_version": "14.1ubuntu1", "version": "14.1ubuntu1" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu1", "version": "14.2ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2160023, 1472288, 2008088, 683311 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - /etc/issue{,.net}, /etc/os-release: Welcome to Stonking Stingray!", " (LP #2154628)", " - Install locale-check command", " - Include systemd service to check the motd.ubuntu.com service", " - Various bashrc extensions", " - Do not install /usr/local dirs with staff group writeability", " - Add default /etc/networks file", " - Remove the upgrade-available flag on package upgrade", " - Restore order line in /etc/host.conf with a comment", " - Build a motd-news-config package", " - Add update-motd scripts", " - etc/legal: legal notice for Ubuntu", " - add Ubuntu logos and set LOGO=ubuntu-logo in etc/os-release", " * Improve Ubuntu delta:", " - d/rules: Stop installing share/* directly into /usr/share to avoid stray", " duplicate files. Thanks to Finn Rayk Gartner. (LP: #2160023)", " - add RELEASE_TYPE, DOCUMENTATION_URL, VENDOR_NAME, and VENDOR_URL", " to /etc/os-release (LP: #1472288)", " - /etc/dpkg/origins/ubuntu: use https for Vendor-URL", " - update-motd scripts:", " + use os-release (LP: #2008088)", " + fix shellcheck complaints", " - remove maintscript, postinst, and Breaks for moving /e/d/motd-news", " from the base-files to motd-news-config package.", " - remove /etc/lsb-release. lsb-release reads /etc/os-release.", " * debian/base-files.maintscript: remove /etc/lsb-release on upgrades", " * share/profile: quote loop variable (LP: #683311)", "" ], "package": "base-files", "version": "14.2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2160023, 1472288, 2008088, 683311 ], "author": "Benjamin Drung ", "date": "Thu, 23 Jul 2026 18:25:51 +0200" }, { "cves": [], "log": [ "", " * Make it easier for derivatives to change the name of the system.", " Thanks to Arnaud Rebillout. Closes: #1111436.", " * Fix copyright-refers-to-symlink-license lintian warning.", " * Fix missing-field-in-dep5-copyright lintian warning.", " * Drop some unused lintian overrides.", "" ], "package": "base-files", "version": "14.2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Santiago Vila ", "date": "Sun, 31 May 2026 11:20:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "bolt", "from_version": { "source_package_name": "bolt", "source_package_version": "0.9.10-1", "version": "0.9.10-1" }, "to_version": { "source_package_name": "bolt", "source_package_version": "0.9.11-1", "version": "0.9.11-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream release", " * Update debhelper compat to 14", " * Update Standards Version to 4.7.4", "" ], "package": "bolt", "version": "0.9.11-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Jeremy Bícha ", "date": "Sun, 05 Jul 2026 17:12:43 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260223", "version": "20260223" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260601", "version": "20260601" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Remove ca-certificates-local example (closes: #988912, #1127101).", " * Update Mozilla certificate authority bundle to version 2.86", " The following certificate authority was added (+):", " + e-Szigno TLS Root CA 2023", " The following certificate authorities were removed (-):", " - QuoVadis Root CA 2", " - QuoVadis Root CA 3", " - DigiCert Assured ID Root CA", " - DigiCert Global Root CA", " - DigiCert High Assurance EV Root CA", " - SwissSign Gold CA - G2", " - SecureTrust CA", " - Secure Global CA", " - COMODO Certification Authority", " - Certigna", " - certSIGN ROOT CA", " - AffirmTrust Commercial", " - AffirmTrust Networking", " - AffirmTrust Premium", " - AffirmTrust Premium ECC", " - TeliaSonera Root CA v1", " - Entrust Root Certification Authority - G2", " - Entrust Root Certification Authority - EC1", " - Trustwave Global Certification Authority", " - Trustwave Global ECC P256 Certification Authority", " - Trustwave Global ECC P384 Certification Authority", " - GLOBALTRUST 2020", " - GTS Root R2", " - FIRMAPROFESIONAL CA ROOT-A WEB", " The following certificate authority was renamed (~):", " ~ \"OISTE Server Root RSA G1\" (removed leading space)", "" ], "package": "ca-certificates", "version": "20260601", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Julien Cristau ", "date": "Mon, 01 Jun 2026 15:39:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-guest-utils", "from_version": { "source_package_name": "cloud-utils", "source_package_version": "0.33-1build1", "version": "0.33-1build1" }, "to_version": { "source_package_name": "cloud-utils", "source_package_version": "0.34-1", "version": "0.34-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version 0.34", " * d/cloud-image-utils.install: drop ubuntu-cloudimg-query.", " Removed upstream.", " * d/control: update standards version to 4.7.4, no changes needed", " * d/control: switch to debhelper-compat 13, no changes needed", " * d/control: drop redundant fields: Priority, Rules-Requires-Root", " * d/control: specify X-Style: black", " * debian/*: apply X-Style via debputy reformat", " * d/copyright: update copyright years for debian/*", " * d/watch: convert to version 5", " * d/u/metadata: remove obsolete fields Contact, Name", " * d/salsa-ci.yml: add Salsa CI pipeline", "" ], "package": "cloud-utils", "version": "0.34-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Paride Legovini ", "date": "Fri, 26 Jun 2026 14:32:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu2", "version": "26.1-0ubuntu2" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2~3gbd85f29d-0ubuntu1", "version": "26.2~3gbd85f29d-0ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2147101 ], "changes": [ { "cves": [], "log": [ "", " * Upstream snapshot based on upstream/main at bd85f29d.", "" ], "package": "cloud-init", "version": "26.2~3gbd85f29d-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Chad Smith ", "date": "Fri, 17 Jul 2026 16:08:31 -0600" }, { "cves": [], "log": [ "", " * drop the following cherry-picks now included:", " + pick-d4566b1a-fix-ubuntu-Configure-arm64-to-use-archive.ubuntu.com", " * d/control: add python3-pyfakefs for testing", " * Upstream snapshot based on upstream/main at fa1bca7e.", " - Bugs fixed in this snapshot: (LP: #2147101)", "" ], "package": "cloud-init", "version": "26.2~2gfa1bca7e-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2147101 ], "author": "Chad Smith ", "date": "Thu, 02 Jul 2026 12:52:15 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init-base", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu2", "version": "26.1-0ubuntu2" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2~3gbd85f29d-0ubuntu1", "version": "26.2~3gbd85f29d-0ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2147101 ], "changes": [ { "cves": [], "log": [ "", " * Upstream snapshot based on upstream/main at bd85f29d.", "" ], "package": "cloud-init", "version": "26.2~3gbd85f29d-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Chad Smith ", "date": "Fri, 17 Jul 2026 16:08:31 -0600" }, { "cves": [], "log": [ "", " * drop the following cherry-picks now included:", " + pick-d4566b1a-fix-ubuntu-Configure-arm64-to-use-archive.ubuntu.com", " * d/control: add python3-pyfakefs for testing", " * Upstream snapshot based on upstream/main at fa1bca7e.", " - Bugs fixed in this snapshot: (LP: #2147101)", "" ], "package": "cloud-init", "version": "26.2~2gfa1bca7e-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2147101 ], "author": "Chad Smith ", "date": "Thu, 02 Jul 2026 12:52:15 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "console-setup", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3", "version": "1.237ubuntu3" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.248ubuntu2", "version": "1.248ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2158626, 2153292 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix separation of primary udeb and noudeb build target", " (LP: #2158626)", "" ], "package": "console-setup", "version": "1.248ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158626 ], "author": "Nick Rosbrook ", "date": "Mon, 29 Jun 2026 11:00:13 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153292). Remaining changes:", " - debian/clean: Delete Keyboard/tree-keymaps/ on clean", " - Add an apport hook", " - debian/control: Build depend on keymapper", " - Make COPYRIGHT a symlink to debian/copyright", " - debian/vtrgb, debian/vtrgb.vga,", " debian/console-setup-linux.setvtrgb.service, debian/rules,", " debian/console-setup-linux.{postinst, prerm}: use Ubuntu's virtual", " terminal color scheme by default, with a VGA color scheme available", " as an alternative.", " - Set keymap and font in the initramfs if possible and sensible", " - Include pc105.tree for ubiquity", " - Add Keyboard/Makefile rule to build pc105.tree", " - Keyboard/keymaptree tool to analyze key maps", " - Keyboard/Makefile: make sure KeyboardNames.pl is built with accurate data from xkb-data.", " - Generate a locale locally for translating keyboard names in kbdnames-maker.", " - Make sure we give a meaningful name to ch layouts: \"Switzerland\"", " instead of \"German (Switzerland), since it includes French too.\"", " - xmlreader: Added model entry to skip model selection", " - Do not set default FONTFACE or FONTSIZE for Lat15, kernel has built-in", " Terminus font, at multitiple sizes, and it correctly selects low/high", " dpi font size, based on screen resolution. (LP 1880266)", " - If the locale is C during configuration, only set CHARMAP to", " ISO-8859-15 on kFreeBSD; otherwise restore the previous behaviour", " from before the kFreeBSD port of using UTF-8 in that case.", " - Handle unattended upgrades without breaking plymouth when updating", " console fonts.", " - setupcon:", " + Explicitly exit 0, so that postinsts don't fail in the event that", " loadkeys can't find a console.", " + Map XKBMODEL=SKIP to '' for compatibility with existing", " configs.", " + handle compressed console maps and font files", " + the system should not have to resolve filenames to find the keymap", " cache on boot.", " - Added templates for keyboard detection", " - debian/keyboard-configuration.config:", " + Map ppc64el/* to XKBMODEL=pc105", " + Set default for Dutch to us(intl), not just us.", " + Set default layout for Kurdish to tr(ku)", " + Set default layout for Vietnam to 'us'", " + change back the french default layout to be fr+oss and not fr+latin9", " + Drop the xkb-keymap bits once again as we're not ready for those yet,", " as it's currently causing an invalid default layout in the installer.", " + keyboard-configuration.{config,templates}: There is no good default", " for layout toggling, stop pretending there is. Console users can set", " one with dpkg-reconfigure or editing /etc/defaults/keyboard", " + nicola_f_bs quirk", " + quirk for Montenegro", " + While sourcing config files to re-seed debconf,", " treat missing XKBOPTIONS as empty. (LP 1762952)", " + If the detect-keyboard debconf plugin is available", " (cdebconf-newt-detect-keys in the installer), then offer to use it to", " detect the keyboard layout.", " + Fix default keyboard selection for language/country combinations lacking", " a proper combined locale (LP 814448).", " * Dropped changes, included in Debian:", " - Keyboard/kbdcompiler: Fix checking ckbcomp success.", " - Keyboard/ckbcomp: Support symbols = [...].", " - keyboard_present.sh: Quiet config/postinst when we have no USB devices", " * Dropped changes, no longer needed:", " - Tolerate absence of setupcon in postinst scripts. Should be fixed by", " refactoring to not have a keyboard-configuration package that needs", " to call setupcon without depending on it.", " - Call setupcon --force only when debian-installer is active", " and always redirect output to /dev/null to not block. (LP: 520546)", " - Fix command injection in ckbcomp", " - Don't copy keyboard-configuration questions to /target in OEM mode.", " oem-config will ask them later, and copying these confuses it.", " - debian/preprocessor: revert the removal of keyboard names (for size) of", " console-setup-udeb: we do need those, since we don't use the simplified", " xkb-keymap template from Debian just yet: this way we can still show", " country/language names when selecting a keyboard, layout or variant", " - Drop several commented out portions of debian/rules related to udeb", " - Drop removal of di-gzipped-ekmaps, which are only used for udebs", " * Dropped several changes that were not explicitly documented in the", " changelog, and are no longer needed:", " - Drop console-setup-pc-ekbd from debian/control", " - Drop Depends: cdebconf-newt-detect-keys", " - Drop udeb portion of vtrgb delta", " * New changes:", " - d/rules: skip udeb rules if building with noudeb profile", "" ], "package": "console-setup", "version": "1.248ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153292 ], "author": "Nick Rosbrook ", "date": "Wed, 17 Jun 2026 13:32:36 -0400" }, { "cves": [], "log": [ "", " * Team upload", "", " [ Samuel Thibault ]", " * control: Use binary:Version instead of source:Version so it can be", " binnmu'd.", "", " [ Updated translations ]", " * Bengali (bn.po) by Khan Sunny", " * Bosnian (bs.po) by pacavarn", " * Galician (gl.po) by HackingAll", " * Lao (lo.po) by BoneNI", " * Occitan (oc.po) by Quentin PAGÈS", " * Swedish (sv.po) by bittin1ddc447d824349b2", " * Tamil (ta.po) by தமிழ்நேரம்", " * Tajik (tg.po) by Victor Ibragimov", " * Traditional Chinese (zh_TW.po) by macylin", "" ], "package": "console-setup", "version": "1.248", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Thu, 14 May 2026 13:44:25 +0200" }, { "cves": [], "log": [ "", " * Rebuild against xkb-data 2.47-1.", "" ], "package": "console-setup", "version": "1.247", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Mon, 30 Mar 2026 21:30:08 +0200" }, { "cves": [], "log": [ "", " * Team upload", "", " * Add missing changelog entry for 1.245 (MR!26).", "", " [ Updated translations ]", " * Bengali (bn.po) by emma peel", " * German (de.po) by Holger Wansing", " * Spanish (es.po) by emma peel", " * Estonian (et.po) by Priit Jõerüüt", " * Galician (gl.po) by HackingAll", " * Kazakh (kk.po) by Baurzhan Muftakhidinov", " * Kannada (kn.po) by Prasannakumar T Bhat", " * Korean (ko.po) by Changwoo Ryu", " * Punjabi (Gurmukhi) (pa.po) by Aman Alam", " * Portuguese (pt.po) by Miguel Figueiredo", " * Russian (ru.po) by Effently", "" ], "package": "console-setup", "version": "1.246", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Mon, 02 Mar 2026 21:04:43 +0100" }, { "cves": [], "log": [ "", " [ Samuel Thibault ]", " * Upload against newer xkb-data (Closes: #1122650)", " * Keyboard/kbdcompiler: Fix checking ckbcomp success.", " * Keyboard/ckbcomp: Support symbols = [...].", "", " [ Daniel Lewart ]", " * Fix runtime errors (closes: #968122)", "" ], "package": "console-setup", "version": "1.245", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Sat, 20 Dec 2025 02:20:42 +0100" }, { "cves": [], "log": [ "", " [ D-I role ]", " * [l10n] Commit changed/added po files (from l10n-sync run at dillon)", "", " [ Philip Hands ]", " * lintian: override depends-on-essential hurd", " * setupcon: use a fixed name for the initrd keymap file (closes: #977877)", "" ], "package": "console-setup", "version": "1.244", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Philip Hands ", "date": "Sun, 26 Oct 2025 08:52:50 +0100" }, { "cves": [], "log": [ "", " [ Holger Wansing ]", " * Change d/copyright and d/bdf2psf.copyright, to remove FSF's (outdated)", " postal address.", "", " [ Samuel Thibault ]", " * keyboard-configuration.templates: Add Left Alt+Left Shift choice for group", " toggle, set as default to avoid conflict with level3(ralt_switch)", " (Closes: #1117976).", " * keyboard-configuration.config: Manage Left Alt+Left Shift, make Alt+Shift", " allocate both left and right alt.", " * keyboard-configuration.preinst: Automatically migrate to Left Alt+Left", " Shift.", " * CHANGES: remove duplicate file.", " * keyboard-configuration.templates: Fix dz(azerty-oss/deadkeys) into dz,", " which is what xkb really provides.", " * keyboard-configuration.config: Fix dz default layout.", "" ], "package": "console-setup", "version": "1.243", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Sun, 19 Oct 2025 16:03:57 +0200" }, { "cves": [], "log": [ "", " * keyboard-configuration.templates: Update dz(la) into dz(azerty-oss).", " * rules: Check that d-i's kmaps have all the d-i layouts.", "" ], "package": "console-setup", "version": "1.242", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Fri, 29 Aug 2025 18:13:24 +0200" }, { "cves": [], "log": [ "", " * keyboard-configuration.templates: Use ca/multix variant instead of", " ca/multi (Closes: #1111994).", "" ], "package": "console-setup", "version": "1.241", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Fri, 29 Aug 2025 01:11:18 +0200" }, { "cves": [], "log": [ "", " [ Updated translations ]", " * Spanish (es.po) by Santiago Vila", " * Russian (ru.po) by Алексей Шилин", " * Tamil (ta.po) by தமிழ்நேரம்", "" ], "package": "console-setup", "version": "1.240", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Cyril Brulebois ", "date": "Sun, 20 Jul 2025 06:30:07 +0200" }, { "cves": [], "log": [ "", " [ NoisyCoil ]", " * Add support for Apple MTP keyboard and Apple SPI Keyboard, as found", " on ARM-based Apple laptops like M1 MacBook Pro and M2 MacBook Air", " (Closes: #1108360).", "" ], "package": "console-setup", "version": "1.239", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Cyril Brulebois ", "date": "Fri, 27 Jun 2025 17:20:08 +0200" }, { "cves": [], "log": [ "", " * Team upload", "", " [ Updated translations ]", " * Belarusian (be.po) by Joe", " * Greek (el.po) by galaxico", " * Hungarian (hu.po) by Szia Tomi", " * Khmer (km.po) by Chou Chamnan", " * Punjabi (Gurmukhi) (pa.po) by DuskyElf", " * Romanian (ro.po) by Remus-Gabriel Chelu", " * Russian (ru.po) by vladiruzz", " * Sinhala (si.po) by leela", " * Telugu (te.po) by Sripath Roy Koganti", " * Uyghur (ug.po) by Abduqadir Abliz", " * Traditional Chinese (zh_TW.po) by reimu105", "" ], "package": "console-setup", "version": "1.238", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Tue, 24 Jun 2025 23:11:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "console-setup-linux", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3", "version": "1.237ubuntu3" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.248ubuntu2", "version": "1.248ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2158626, 2153292 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix separation of primary udeb and noudeb build target", " (LP: #2158626)", "" ], "package": "console-setup", "version": "1.248ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158626 ], "author": "Nick Rosbrook ", "date": "Mon, 29 Jun 2026 11:00:13 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153292). Remaining changes:", " - debian/clean: Delete Keyboard/tree-keymaps/ on clean", " - Add an apport hook", " - debian/control: Build depend on keymapper", " - Make COPYRIGHT a symlink to debian/copyright", " - debian/vtrgb, debian/vtrgb.vga,", " debian/console-setup-linux.setvtrgb.service, debian/rules,", " debian/console-setup-linux.{postinst, prerm}: use Ubuntu's virtual", " terminal color scheme by default, with a VGA color scheme available", " as an alternative.", " - Set keymap and font in the initramfs if possible and sensible", " - Include pc105.tree for ubiquity", " - Add Keyboard/Makefile rule to build pc105.tree", " - Keyboard/keymaptree tool to analyze key maps", " - Keyboard/Makefile: make sure KeyboardNames.pl is built with accurate data from xkb-data.", " - Generate a locale locally for translating keyboard names in kbdnames-maker.", " - Make sure we give a meaningful name to ch layouts: \"Switzerland\"", " instead of \"German (Switzerland), since it includes French too.\"", " - xmlreader: Added model entry to skip model selection", " - Do not set default FONTFACE or FONTSIZE for Lat15, kernel has built-in", " Terminus font, at multitiple sizes, and it correctly selects low/high", " dpi font size, based on screen resolution. (LP 1880266)", " - If the locale is C during configuration, only set CHARMAP to", " ISO-8859-15 on kFreeBSD; otherwise restore the previous behaviour", " from before the kFreeBSD port of using UTF-8 in that case.", " - Handle unattended upgrades without breaking plymouth when updating", " console fonts.", " - setupcon:", " + Explicitly exit 0, so that postinsts don't fail in the event that", " loadkeys can't find a console.", " + Map XKBMODEL=SKIP to '' for compatibility with existing", " configs.", " + handle compressed console maps and font files", " + the system should not have to resolve filenames to find the keymap", " cache on boot.", " - Added templates for keyboard detection", " - debian/keyboard-configuration.config:", " + Map ppc64el/* to XKBMODEL=pc105", " + Set default for Dutch to us(intl), not just us.", " + Set default layout for Kurdish to tr(ku)", " + Set default layout for Vietnam to 'us'", " + change back the french default layout to be fr+oss and not fr+latin9", " + Drop the xkb-keymap bits once again as we're not ready for those yet,", " as it's currently causing an invalid default layout in the installer.", " + keyboard-configuration.{config,templates}: There is no good default", " for layout toggling, stop pretending there is. Console users can set", " one with dpkg-reconfigure or editing /etc/defaults/keyboard", " + nicola_f_bs quirk", " + quirk for Montenegro", " + While sourcing config files to re-seed debconf,", " treat missing XKBOPTIONS as empty. (LP 1762952)", " + If the detect-keyboard debconf plugin is available", " (cdebconf-newt-detect-keys in the installer), then offer to use it to", " detect the keyboard layout.", " + Fix default keyboard selection for language/country combinations lacking", " a proper combined locale (LP 814448).", " * Dropped changes, included in Debian:", " - Keyboard/kbdcompiler: Fix checking ckbcomp success.", " - Keyboard/ckbcomp: Support symbols = [...].", " - keyboard_present.sh: Quiet config/postinst when we have no USB devices", " * Dropped changes, no longer needed:", " - Tolerate absence of setupcon in postinst scripts. Should be fixed by", " refactoring to not have a keyboard-configuration package that needs", " to call setupcon without depending on it.", " - Call setupcon --force only when debian-installer is active", " and always redirect output to /dev/null to not block. (LP: 520546)", " - Fix command injection in ckbcomp", " - Don't copy keyboard-configuration questions to /target in OEM mode.", " oem-config will ask them later, and copying these confuses it.", " - debian/preprocessor: revert the removal of keyboard names (for size) of", " console-setup-udeb: we do need those, since we don't use the simplified", " xkb-keymap template from Debian just yet: this way we can still show", " country/language names when selecting a keyboard, layout or variant", " - Drop several commented out portions of debian/rules related to udeb", " - Drop removal of di-gzipped-ekmaps, which are only used for udebs", " * Dropped several changes that were not explicitly documented in the", " changelog, and are no longer needed:", " - Drop console-setup-pc-ekbd from debian/control", " - Drop Depends: cdebconf-newt-detect-keys", " - Drop udeb portion of vtrgb delta", " * New changes:", " - d/rules: skip udeb rules if building with noudeb profile", "" ], "package": "console-setup", "version": "1.248ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153292 ], "author": "Nick Rosbrook ", "date": "Wed, 17 Jun 2026 13:32:36 -0400" }, { "cves": [], "log": [ "", " * Team upload", "", " [ Samuel Thibault ]", " * control: Use binary:Version instead of source:Version so it can be", " binnmu'd.", "", " [ Updated translations ]", " * Bengali (bn.po) by Khan Sunny", " * Bosnian (bs.po) by pacavarn", " * Galician (gl.po) by HackingAll", " * Lao (lo.po) by BoneNI", " * Occitan (oc.po) by Quentin PAGÈS", " * Swedish (sv.po) by bittin1ddc447d824349b2", " * Tamil (ta.po) by தமிழ்நேரம்", " * Tajik (tg.po) by Victor Ibragimov", " * Traditional Chinese (zh_TW.po) by macylin", "" ], "package": "console-setup", "version": "1.248", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Thu, 14 May 2026 13:44:25 +0200" }, { "cves": [], "log": [ "", " * Rebuild against xkb-data 2.47-1.", "" ], "package": "console-setup", "version": "1.247", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Mon, 30 Mar 2026 21:30:08 +0200" }, { "cves": [], "log": [ "", " * Team upload", "", " * Add missing changelog entry for 1.245 (MR!26).", "", " [ Updated translations ]", " * Bengali (bn.po) by emma peel", " * German (de.po) by Holger Wansing", " * Spanish (es.po) by emma peel", " * Estonian (et.po) by Priit Jõerüüt", " * Galician (gl.po) by HackingAll", " * Kazakh (kk.po) by Baurzhan Muftakhidinov", " * Kannada (kn.po) by Prasannakumar T Bhat", " * Korean (ko.po) by Changwoo Ryu", " * Punjabi (Gurmukhi) (pa.po) by Aman Alam", " * Portuguese (pt.po) by Miguel Figueiredo", " * Russian (ru.po) by Effently", "" ], "package": "console-setup", "version": "1.246", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Mon, 02 Mar 2026 21:04:43 +0100" }, { "cves": [], "log": [ "", " [ Samuel Thibault ]", " * Upload against newer xkb-data (Closes: #1122650)", " * Keyboard/kbdcompiler: Fix checking ckbcomp success.", " * Keyboard/ckbcomp: Support symbols = [...].", "", " [ Daniel Lewart ]", " * Fix runtime errors (closes: #968122)", "" ], "package": "console-setup", "version": "1.245", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Sat, 20 Dec 2025 02:20:42 +0100" }, { "cves": [], "log": [ "", " [ D-I role ]", " * [l10n] Commit changed/added po files (from l10n-sync run at dillon)", "", " [ Philip Hands ]", " * lintian: override depends-on-essential hurd", " * setupcon: use a fixed name for the initrd keymap file (closes: #977877)", "" ], "package": "console-setup", "version": "1.244", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Philip Hands ", "date": "Sun, 26 Oct 2025 08:52:50 +0100" }, { "cves": [], "log": [ "", " [ Holger Wansing ]", " * Change d/copyright and d/bdf2psf.copyright, to remove FSF's (outdated)", " postal address.", "", " [ Samuel Thibault ]", " * keyboard-configuration.templates: Add Left Alt+Left Shift choice for group", " toggle, set as default to avoid conflict with level3(ralt_switch)", " (Closes: #1117976).", " * keyboard-configuration.config: Manage Left Alt+Left Shift, make Alt+Shift", " allocate both left and right alt.", " * keyboard-configuration.preinst: Automatically migrate to Left Alt+Left", " Shift.", " * CHANGES: remove duplicate file.", " * keyboard-configuration.templates: Fix dz(azerty-oss/deadkeys) into dz,", " which is what xkb really provides.", " * keyboard-configuration.config: Fix dz default layout.", "" ], "package": "console-setup", "version": "1.243", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Sun, 19 Oct 2025 16:03:57 +0200" }, { "cves": [], "log": [ "", " * keyboard-configuration.templates: Update dz(la) into dz(azerty-oss).", " * rules: Check that d-i's kmaps have all the d-i layouts.", "" ], "package": "console-setup", "version": "1.242", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Fri, 29 Aug 2025 18:13:24 +0200" }, { "cves": [], "log": [ "", " * keyboard-configuration.templates: Use ca/multix variant instead of", " ca/multi (Closes: #1111994).", "" ], "package": "console-setup", "version": "1.241", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Fri, 29 Aug 2025 01:11:18 +0200" }, { "cves": [], "log": [ "", " [ Updated translations ]", " * Spanish (es.po) by Santiago Vila", " * Russian (ru.po) by Алексей Шилин", " * Tamil (ta.po) by தமிழ்நேரம்", "" ], "package": "console-setup", "version": "1.240", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Cyril Brulebois ", "date": "Sun, 20 Jul 2025 06:30:07 +0200" }, { "cves": [], "log": [ "", " [ NoisyCoil ]", " * Add support for Apple MTP keyboard and Apple SPI Keyboard, as found", " on ARM-based Apple laptops like M1 MacBook Pro and M2 MacBook Air", " (Closes: #1108360).", "" ], "package": "console-setup", "version": "1.239", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Cyril Brulebois ", "date": "Fri, 27 Jun 2025 17:20:08 +0200" }, { "cves": [], "log": [ "", " * Team upload", "", " [ Updated translations ]", " * Belarusian (be.po) by Joe", " * Greek (el.po) by galaxico", " * Hungarian (hu.po) by Szia Tomi", " * Khmer (km.po) by Chou Chamnan", " * Punjabi (Gurmukhi) (pa.po) by DuskyElf", " * Romanian (ro.po) by Remus-Gabriel Chelu", " * Russian (ru.po) by vladiruzz", " * Sinhala (si.po) by leela", " * Telugu (te.po) by Sripath Roy Koganti", " * Uyghur (ug.po) by Abduqadir Abliz", " * Traditional Chinese (zh_TW.po) by reimu105", "" ], "package": "console-setup", "version": "1.238", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Tue, 24 Jun 2025 23:11:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "coreutils", "from_version": { "source_package_name": "coreutils-from", "source_package_version": "0.0.0~ubuntu27", "version": "9.5-1ubuntu2+0.0.0~ubuntu27" }, "to_version": { "source_package_name": "coreutils-from", "source_package_version": "0.0.0~ubuntu28", "version": "9.5-1ubuntu2+0.0.0~ubuntu28" }, "cves": [], "launchpad_bugs_fixed": [ 2158691 ], "changes": [ { "cves": [], "log": [ "", " * uutils: Reinstate gnucp (LP: #2158691)", "" ], "package": "coreutils-from", "version": "0.0.0~ubuntu28", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158691 ], "author": "Simon Johnsson ", "date": "Tue, 30 Jun 2026 10:05:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "coreutils-from-uutils", "from_version": { "source_package_name": "coreutils-from", "source_package_version": "0.0.0~ubuntu27", "version": "0.0.0~ubuntu27" }, "to_version": { "source_package_name": "coreutils-from", "source_package_version": "0.0.0~ubuntu28", "version": "0.0.0~ubuntu28" }, "cves": [], "launchpad_bugs_fixed": [ 2158691 ], "changes": [ { "cves": [], "log": [ "", " * uutils: Reinstate gnucp (LP: #2158691)", "" ], "package": "coreutils-from", "version": "0.0.0~ubuntu28", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158691 ], "author": "Simon Johnsson ", "date": "Tue, 30 Jun 2026 10:05:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2", "version": "8.18.0-1ubuntu2" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu1", "version": "8.20.0-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "launchpad_bugs_fixed": [ 2153275 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153275). Remaining changes:", " - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe", " - d/control: don't build-depend on python3-impacket and stunnel on i386", " * Dropped delta removed earlier:", " - d/control: do not use gnutls for the curl binary", " [Dropped in 8.13.0-2]", "" ], "package": "curl", "version": "8.20.0-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153275 ], "author": "Ural Tunaboyu ", "date": "Fri, 29 May 2026 09:10:13 -0700" }, { "cves": [], "log": [ "", " * debian/patches/event-fix-wakeup-consumption.patch: cherry-pick from", " upstream. (Closes: #1136378, #1136264)", "" ], "package": "curl", "version": "8.20.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 13 May 2026 11:15:17 +0200" }, { "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe", " - d/control: do not use gnutls for the curl binary", " - d/control: don't build-depend on python3-impacket and stunnel on i386", " * Dropped changes:", " - SECURITY UPDATE: bad reuse of HTTP Negotiate connection", " + debian/patches/CVE-2026-1965-1.patch: fix reuse of connections using", " HTTP Negotiate in lib/url.c.", " + debian/patches/CVE-2026-1965-2.patch: fix copy and paste", " url_match_auth_nego mistake in lib/url.c.", " + CVE-2026-1965", " - SECURITY UPDATE: token leak with redirect and netrc", " + debian/patches/CVE-2026-3783.patch: only send bearer if auth is", " allowed in lib/http.c, tests/data/Makefile.am, tests/data/test2006.", " + CVE-2026-3783", " - SECURITY UPDATE: wrong proxy connection reuse with credentials", " + debian/patches/CVE-2026-3784.patch: add additional tests in", " lib/url.c, tests/http/test_13_proxy_auth.py,", " tests/http/testenv/curl.py.", " + CVE-2026-3784", " - SECURITY UPDATE: use after free in SMB connection reuse", " + debian/patches/CVE-2026-3805.patch: free the path in the request", " struct properly in lib/smb.c.", " + CVE-2026-3805", " - SECURITY UPDATE: connection reuse ignores TLS requirement", " + debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls", " connection if new requires TLS in lib/url.c.", " + CVE-2026-4873", " - SECURITY UPDATE: wrong reuse of HTTP Negotiate connection", " + debian/patches/CVE-2026-5545.patch: improve connection reuse on", " negotiate in lib/url.c.", " + CVE-2026-5545", " - SECURITY UPDATE: wrong reuse of SMB connection", " + debian/patches/CVE-2026-5773.patch: disable connection reuse for", " SMB(S) in lib/smb.c.", " + CVE-2026-5773", " - SECURITY UPDATE: proxy credentials leak over redirect-to proxy", " + debian/patches/CVE-2026-6253-pre1.patch: chunked response, error code", " in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c, tests/*.", " + debian/patches/CVE-2026-6253-pre2.patch: fix error code, remove SMB", " use in tests/data/test445.", " + debian/patches/CVE-2026-6253.patch: clear the proxy credentials as", " well on port or scheme change in lib/http.c, lib/transfer.*, tests/*.", " + CVE-2026-6253", " - SECURITY UPDATE: stale custom cookie host causes cookie leak", " + debian/patches/CVE-2026-6276.patch: move cookiehost to struct", " SingleRequest in lib/http.c, lib/request.c, lib/request.h, lib/url.c,", " lib/urldata.h, tests/*.", " + CVE-2026-6276", " - SECURITY UPDATE: netrc credential leak with reused proxy connection", " + debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes", " pushed over insecure connections in lib/http2.c.", " + debian/patches/CVE-2026-6429-pre2.patch: same origin tests in", " lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.", " + debian/patches/CVE-2026-6429.patch: clear credentials better on", " redirect in lib/http.c, tests/*.", " + CVE-2026-6429", " - SECURITY UPDATE: cross-proxy Digest auth state leak", " + debian/patches/CVE-2026-7168.patch: clear proxy auth properties when", " switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.", " + CVE-2026-7168", "" ], "package": "curl", "version": "8.20.0-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Tue, 05 May 2026 07:20:49 -0500" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0", "" ], "package": "curl", "version": "8.20.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Wed, 29 Apr 2026 11:38:11 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0~rc3", "" ], "package": "curl", "version": "8.20.0~rc3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Thu, 23 Apr 2026 07:44:08 -0700" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0~rc2", "", " [ Samuel Henrique ]", " * Bump Standards-Version to 4.7.4.", " * debian/copyright: Remove files from rtmp support, dropped upstream.", "", " [ Carlos Henrique Lima Melara ]", " * debian/patches: refresh patches.", " - test459-switch-to-mode-warn-for-stderr-check.patch: drop patch merged", " upstream.", "", "" ], "package": "curl", "version": "8.20.0~rc2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Tue, 14 Apr 2026 22:22:42 -0300" }, { "cves": [], "log": [ "", " * debian/rules: revert parallel tests multiplier to 4.", "" ], "package": "curl", "version": "8.19.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Thu, 26 Mar 2026 22:28:12 -0300" }, { "cves": [], "log": [ "", " [ Samuel Henrique ]", " * debian/rules: Don't skip any tests and increase parallel factor to 7.", "", " [ Carlos Henrique Lima Melara ]", " * debian/patches/test459-switch-to-mode-warn-for-stderr-check.patch:", " cherry-pick from upstream. (Closes: #1131157)", "" ], "package": "curl", "version": "8.19.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Thu, 26 Mar 2026 21:16:48 -0300" }, { "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" } ], "log": [ "", " * New upstream version 8.19.0.", " - Fix CVE-2026-1965, CVE-2026-3783, CVE-2026-3784 and CVE-2026-3805.", " * debian/control: drop leftover quilt build-dep. (Closes: #1129269)", "" ], "package": "curl", "version": "8.19.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 11 Mar 2026 19:40:54 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.19.0~rc3.", " * debian/patches: refresh patches.", " - revert-to-recursive-macros.patch: drop, in the release.", "" ], "package": "curl", "version": "8.19.0~rc3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Fri, 27 Feb 2026 19:06:29 -0300" }, { "cves": [], "log": [ "", " * debian/patches/revert-to-recursive-macros.patch: cherry-pick from", " upstream. (Closes: #1128884)", "" ], "package": "curl", "version": "8.19.0~rc2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Mon, 23 Feb 2026 21:12:59 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.19.0~rc2", " * Refresh patches", " * d/copyright: Drop removed files", "" ], "package": "curl", "version": "8.19.0~rc2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Sat, 21 Feb 2026 09:44:52 -0800" }, { "cves": [], "log": [ "", " [ Simon McVittie ]", " * debian/rules: Replace LDFLAGS in curl-config(1) for multiarch", " co-installability. (Closes: #1124987)", "" ], "package": "curl", "version": "8.18.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 14 Jan 2026 23:10:10 -0300" }, { "cves": [ { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: connection reuse ignores TLS requirement", " - debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls", " connection if new requires TLS in lib/url.c.", " - CVE-2026-4873", " * SECURITY UPDATE: wrong reuse of HTTP Negotiate connection", " - debian/patches/CVE-2026-5545.patch: improve connection reuse on", " negotiate in lib/url.c.", " - CVE-2026-5545", " * SECURITY UPDATE: wrong reuse of SMB connection", " - debian/patches/CVE-2026-5773.patch: disable connection reuse for", " SMB(S) in lib/smb.c.", " - CVE-2026-5773", " * SECURITY UPDATE: proxy credentials leak over redirect-to proxy", " - debian/patches/CVE-2026-6253-pre1.patch: chunked response, error code", " in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c, tests/*.", " - debian/patches/CVE-2026-6253-pre2.patch: fix error code, remove SMB", " use in tests/data/test445.", " - debian/patches/CVE-2026-6253.patch: clear the proxy credentials as", " well on port or scheme change in lib/http.c, lib/transfer.*, tests/*.", " - CVE-2026-6253", " * SECURITY UPDATE: stale custom cookie host causes cookie leak", " - debian/patches/CVE-2026-6276.patch: move cookiehost to struct", " SingleRequest in lib/http.c, lib/request.c, lib/request.h, lib/url.c,", " lib/urldata.h, tests/*.", " - CVE-2026-6276", " * SECURITY UPDATE: netrc credential leak with reused proxy connection", " - debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes", " pushed over insecure connections in lib/http2.c.", " - debian/patches/CVE-2026-6429-pre2.patch: same origin tests in", " lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.", " - debian/patches/CVE-2026-6429.patch: clear credentials better on", " redirect in lib/http.c, tests/*.", " - CVE-2026-6429", " * SECURITY UPDATE: cross-proxy Digest auth state leak", " - debian/patches/CVE-2026-7168.patch: clear proxy auth properties when", " switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.", " - CVE-2026-7168", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 29 Apr 2026 07:35:43 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "dbus", "from_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu1", "version": "1.16.2-5ubuntu1" }, "to_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu2", "version": "1.16.2-5ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Stop providing default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", " * d/control: Prefer dbus-broker for the user bus", " dbus-broker will be the default user bus provider in Ubuntu. (LP: #2015538)", " * d/p/u/aa-get-connection-apparmor-security-context.patch: Drop patch.", " The GetConnectionAppArmorSecurityContext method has been deprecated since", " 2015. All its users have been ported away. (LP: #1489489)", "" ], "package": "dbus", "version": "1.16.2-5ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 18:00:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dbus-bin", "from_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu1", "version": "1.16.2-5ubuntu1" }, "to_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu2", "version": "1.16.2-5ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Stop providing default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", " * d/control: Prefer dbus-broker for the user bus", " dbus-broker will be the default user bus provider in Ubuntu. (LP: #2015538)", " * d/p/u/aa-get-connection-apparmor-security-context.patch: Drop patch.", " The GetConnectionAppArmorSecurityContext method has been deprecated since", " 2015. All its users have been ported away. (LP: #1489489)", "" ], "package": "dbus", "version": "1.16.2-5ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 18:00:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dbus-daemon", "from_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu1", "version": "1.16.2-5ubuntu1" }, "to_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu2", "version": "1.16.2-5ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Stop providing default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", " * d/control: Prefer dbus-broker for the user bus", " dbus-broker will be the default user bus provider in Ubuntu. (LP: #2015538)", " * d/p/u/aa-get-connection-apparmor-security-context.patch: Drop patch.", " The GetConnectionAppArmorSecurityContext method has been deprecated since", " 2015. All its users have been ported away. (LP: #1489489)", "" ], "package": "dbus", "version": "1.16.2-5ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 18:00:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dbus-session-bus-common", "from_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu1", "version": "1.16.2-5ubuntu1" }, "to_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu2", "version": "1.16.2-5ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Stop providing default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", " * d/control: Prefer dbus-broker for the user bus", " dbus-broker will be the default user bus provider in Ubuntu. (LP: #2015538)", " * d/p/u/aa-get-connection-apparmor-security-context.patch: Drop patch.", " The GetConnectionAppArmorSecurityContext method has been deprecated since", " 2015. All its users have been ported away. (LP: #1489489)", "" ], "package": "dbus", "version": "1.16.2-5ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 18:00:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dbus-system-bus-common", "from_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu1", "version": "1.16.2-5ubuntu1" }, "to_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu2", "version": "1.16.2-5ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Stop providing default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", " * d/control: Prefer dbus-broker for the user bus", " dbus-broker will be the default user bus provider in Ubuntu. (LP: #2015538)", " * d/p/u/aa-get-connection-apparmor-security-context.patch: Drop patch.", " The GetConnectionAppArmorSecurityContext method has been deprecated since", " 2015. All its users have been ported away. (LP: #1489489)", "" ], "package": "dbus", "version": "1.16.2-5ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 18:00:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dbus-user-session", "from_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu1", "version": "1.16.2-5ubuntu1" }, "to_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu2", "version": "1.16.2-5ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Stop providing default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", " * d/control: Prefer dbus-broker for the user bus", " dbus-broker will be the default user bus provider in Ubuntu. (LP: #2015538)", " * d/p/u/aa-get-connection-apparmor-security-context.patch: Drop patch.", " The GetConnectionAppArmorSecurityContext method has been deprecated since", " 2015. All its users have been ported away. (LP: #1489489)", "" ], "package": "dbus", "version": "1.16.2-5ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 18:00:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dhcpcd-base", "from_version": { "source_package_name": "dhcpcd", "source_package_version": "1:10.3.2-3", "version": "1:10.3.2-3" }, "to_version": { "source_package_name": "dhcpcd", "source_package_version": "1:10.3.2-4", "version": "1:10.3.2-4" }, "cves": [ { "cve": "CVE-2026-56113", "url": "https://ubuntu.com/security/CVE-2026-56113", "cve_description": "dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" }, { "cve": "CVE-2026-56114", "url": "https://ubuntu.com/security/CVE-2026-56114", "cve_description": "dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" }, { "cve": "CVE-2026-56116", "url": "https://ubuntu.com/security/CVE-2026-56116", "cve_description": "dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" }, { "cve": "CVE-2026-56117", "url": "https://ubuntu.com/security/CVE-2026-56117", "cve_description": "dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-56113", "url": "https://ubuntu.com/security/CVE-2026-56113", "cve_description": "dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" }, { "cve": "CVE-2026-56114", "url": "https://ubuntu.com/security/CVE-2026-56114", "cve_description": "dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" }, { "cve": "CVE-2026-56116", "url": "https://ubuntu.com/security/CVE-2026-56116", "cve_description": "dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" }, { "cve": "CVE-2026-56117", "url": "https://ubuntu.com/security/CVE-2026-56117", "cve_description": "dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.", "cve_priority": "medium", "cve_public_date": "2026-06-23 17:17:00 UTC" } ], "log": [ "", " * [patches] (Closes: #1140767)", " + Cherry-pick upstream fix for CVE-2026-56113 (commit 5733d3c).", " + Cherry-pick upstream fix for CVE-2026-56114 (commit 2f00c7b).", " + Cherry-pick upstream fix for CVE-2026-56116 (commit 708b4a5).", " + Cherry-pick upstream fix for CVE-2026-56117 (commit 78ea09e).", "" ], "package": "dhcpcd", "version": "1:10.3.2-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Fri, 26 Jun 2026 15:24:47 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "dirmngr", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "0.69", "version": "0.69" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "0.73-1", "version": "0.73-1" }, "cves": [], "launchpad_bugs_fixed": [ 2131678 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release:", " - Correct Debian/Devuan codename Experimental to RC-Buggy", " - Support testing against the installed data", " * autopkgtest: reduce dependencies to the needed minimum", "" ], "package": "distro-info-data", "version": "0.73-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Benjamin Drung ", "date": "Sun, 19 Jul 2026 15:55:08 +0200" }, { "cves": [], "log": [ "", " * New upstream release with only test code changes:", " - Format Python code with black 26.3", " - Fix type hints and add type hints to all functions", " - Makefile: Add lint target", " - Makefile: add linter check for isort, mypy", " - Support Python 3.6 for Ubuntu SRUs", "" ], "package": "distro-info-data", "version": "0.72-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Benjamin Drung ", "date": "Mon, 13 Jul 2026 23:06:41 +0200" }, { "cves": [], "log": [ "", " * Convert source package from a native package to an upstream package to", " make it easier to track differences in the data versus in the packaging.", "" ], "package": "distro-info-data", "version": "0.71-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Benjamin Drung ", "date": "Fri, 10 Jul 2026 01:00:47 +0200" }, { "cves": [], "log": [ "", " [ Stefano Rivera ]", " * Flesh out missing changelog entries in 0.69.", "", " [ Benjamin Drung ]", " * Ubuntu Legacy Support extension has been increased to 15 years", " (LP: #2131678)", " * Drop obsolete Priority: optional", " * Bump Standards-Version to 4.7.4", "" ], "package": "distro-info-data", "version": "0.70", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2131678 ], "author": "Benjamin Drung ", "date": "Wed, 24 Jun 2026 12:00:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dmidecode", "from_version": { "source_package_name": "dmidecode", "source_package_version": "3.7-1", "version": "3.7-1" }, "to_version": { "source_package_name": "dmidecode", "source_package_version": "3.7-1ubuntu1", "version": "3.7-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148318 ], "changes": [ { "cves": [], "log": [ "", " * Display slot information for EDSFF (LP: #2148318)", "" ], "package": "dmidecode", "version": "3.7-1ubuntu1", "urgency": "high", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148318 ], "author": "Ponnuvel Palaniyappan ", "date": "Mon, 08 Jun 2026 18:40:05 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "e2fsprogs", "from_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.2-3ubuntu4", "version": "1.47.2-3ubuntu4" }, "to_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.4-1", "version": "1.47.4-1" }, "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "launchpad_bugs_fixed": [ 2138219, 2132257, 2025339, 1939409, 1817097 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix pkgconfig call that results in inability", " to find udev rules.d in dh_install. Patch supplied by", " Helmut Grohne in Debian bug 1126636. (LP: #2138219)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu4", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138219 ], "author": "John Chittum ", "date": "Fri, 13 Feb 2026 07:17:00 -0500" }, { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Mon, 02 Feb 2026 21:34:31 +0100" }, { "cves": [], "log": [ "", " * Rebuild to include updated RISC-V base ISA RVA23", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Wed, 03 Sep 2025 17:46:20 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu1", "urgency": "low", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Thu, 12 Jun 2025 15:13:43 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-1ubuntu1", "urgency": "low", "distributions": "plucky", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 07 Jan 2025 21:26:01 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.1-1ubuntu1", "urgency": "low", "distributions": "oracular", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 25 Jun 2024 11:33:08 +0200" }, { "cves": [], "log": [ "", " * No change rebuild against libfuse2t64.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu4", "urgency": "high", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 08 Apr 2024 16:38:40 +0200" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 07:33:00 +0000" }, { "cves": [], "log": [ "", " * Make the provides for the renamed packages versioned.", " * Break against the first version not building the t64 packages anymore.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Tue, 12 Mar 2024 21:22:45 +0100" }, { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Tue, 12 Mar 2024 11:31:16 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.3ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 04 Mar 2024 08:18:05 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian Unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Wed, 26 Jul 2023 13:26:17 -0500" }, { "cves": [], "log": [ "", " * Temporarily disable orphan_file by default, such that fsck from jammy", " can check ext4 created in mantic. Given the new incompat ext4 features", " that v5.15 & hwe kernels support, ideally e2fsprogs 1.47.0 should be", " SRUed into jammy. LP: #2025339", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu2", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [ 2025339 ], "author": "Dimitri John Ledkov ", "date": "Thu, 29 Jun 2023 10:14:32 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Disable the metadata_csum_seed feature again, as grub does not yet", " support it (Closes: #866603)", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu1", "urgency": "low", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 17 Feb 2023 11:58:55 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes (applied in Debian):", " - 0001-tests-support-older-versions-of-timeout-in-r_corrupt", " - CVE-2022-1304.patch", "" ], "package": "e2fsprogs", "version": "1.46.6~rc1-1ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Tue, 22 Nov 2022 15:15:27 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds read/write vulnerability", " Issue leads to segmentation fault and possibly arbitrary code", " execution via a specially crafted filesystem.", " - debian/patches/CVE-2022-1304.patch: checks that all leaf nodes of", " file system contain at least one extent.", " - CVE-2022-1304", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu2", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Mark Esler ", "date": "Thu, 02 Jun 2022 22:03:15 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 08 Jan 2022 21:02:36 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 01 Jan 2022 22:41:06 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.4-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Wed, 03 Nov 2021 09:32:13 +0100" }, { "cves": [], "log": [ "", " * Restore mke2fs capability to create files adding patch", "", " - mke2fs: fix creating a file system image w/o a pre-existing file", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu3", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Mon, 30 Aug 2021 17:58:29 +0200" }, { "cves": [], "log": [ "", " * Fix failing tests on bigendian system (LP: #1939409)", " using upstream patches queued for 1.46.4:", "", " - e2fsck: fix f_baddotdir failure on big-endian systems", " - libext2fs: fix translation of Posix ACL's on big-endian systems", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1939409 ], "author": "Heinrich Schuchardt ", "date": "Wed, 11 Aug 2021 19:04:33 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian experimental. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Tue, 10 Aug 2021 10:07:26 +0200" }, { "cves": [], "log": [ "", " * Apply upstream fix for unaligned memory access.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 27 May 2021 13:20:34 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 10 May 2021 14:31:18 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to drop the udeb package.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu2", "urgency": "medium", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 22 Feb 2021 10:30:51 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu1", "urgency": "low", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 29 Jan 2021 12:37:12 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.6-1ubuntu1", "urgency": "low", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 01 May 2020 14:47:58 -0700" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes, included upstream:", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", "" ], "package": "e2fsprogs", "version": "1.45.5-2ubuntu1", "urgency": "low", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2020 22:08:18 -0800" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - CVE-2019-5188", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Wed, 22 Jan 2020 12:01:15 -0300" }, { "cves": [ { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write on the heap", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", " - CVE-2019-5094", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu2", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Mon, 30 Sep 2019 14:57:59 -0300" }, { "cves": [], "log": [ "", " * Merge with Debian testing, remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Adam Conrad ", "date": "Sun, 08 Sep 2019 04:12:08 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size.", "" ], "package": "e2fsprogs", "version": "1.45.2-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 24 Jun 2019 11:51:53 +0200" }, { "cves": [], "log": [ "", " * Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size. LP: #1817097", "" ], "package": "e2fsprogs", "version": "1.45.1-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [ 1817097 ], "author": "Dimitri John Ledkov ", "date": "Wed, 15 May 2019 16:15:22 +0200" } ], "notes": null, "is_version_downgrade": true }, { "name": "efibootmgr", "from_version": { "source_package_name": "efibootmgr", "source_package_version": "18-4ubuntu1", "version": "18-4ubuntu1" }, "to_version": { "source_package_name": "efibootmgr", "source_package_version": "18-4.1ubuntu1", "version": "18-4.1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - d/p/fix-active-inactive-commands.patch: Fix active and inactive commands.", "" ], "package": "efibootmgr", "version": "18-4.1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Zara Grigoryan ", "date": "Wed, 22 Jul 2026 14:31:49 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Don't build with -Wl,--fatal-warnings. (Closes: #1110451)", "" ], "package": "efibootmgr", "version": "18-4.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adrian Bunk ", "date": "Mon, 29 Dec 2025 20:20:44 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "exfatprogs", "from_version": { "source_package_name": "exfatprogs", "source_package_version": "1.4.2-1", "version": "1.4.2-1" }, "to_version": { "source_package_name": "exfatprogs", "source_package_version": "1.4.2-2", "version": "1.4.2-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * d/control: Breaks libblockdev3 and udisks2, which were not", " compatible with exfatprogs 1.4.0, due to the added", " default partition table in mkfs.exfat and output format", " changes in tune.exfat.", " Thanks to Michael Biebl for fixing both very quickly.", "" ], "package": "exfatprogs", "version": "1.4.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sven Hoexter ", "date": "Thu, 02 Jul 2026 22:04:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "fwupd", "from_version": { "source_package_name": "fwupd", "source_package_version": "2.1.1-1ubuntu4", "version": "2.1.1-1ubuntu4" }, "to_version": { "source_package_name": "fwupd", "source_package_version": "2.1.6-3ubuntu1", "version": "2.1.6-3ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148183, 2156480, 2156479, 2156612, 2148673, 2147129, 2146332, 2143688, 2142298, 2139611, 2138609 ], "changes": [ { "cves": [], "log": [ "", " * d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch", " - Fix recovery key prompt for multi-boot systems. Previously an error made", " fwupdmgr prompt all systems where hardware-backed FDE was detected, when", " it should only verify against the current system IFF it is running under", " snapd FDE. (LP: #2148183)", " - Fix incorrect error propagation. If CTRL-D was sent, the process would", " expose an incorrect error propagation in the recovery key verification.", " (LP: #2156480)", " - Link to Ubuntu TPM docs if snapd FDE is detected. Previously bugs", " related to this temporary patch could get reported upstream, leading", " to confusion as this is a short-term solution that will not get merged", " upstream.", " * d/p/mtd-fall-back-to-generic-firmware.patch: Fix an error on MTD devices", " where gtype was incorrectly set to G_TYPE_INVALID (LP: #2156479)", " * d/p/fix-device-locker-crash.patch: Fix an error where the genesys-gl32xx", " plugin would crash due to using the wrong detach and attach callbacks", " (LP: #2156612)", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148183, 2156480, 2156479, 2156612 ], "author": "Simon Johnsson ", "date": "Thu, 18 Jun 2026 16:01:12 +0200" }, { "cves": [], "log": [ "", " * d/p/algoltek-usbcr-Restore-vendor-ID-check-in-probe-func.patch:", " Fix algotek plugin probing hardware it shouldn't. (LP: #2148673)", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148673 ], "author": "Mario Limonciello ", "date": "Fri, 17 Apr 2026 13:44:18 -0500" }, { "cves": [], "log": [ "", " * d/p/fix-notify-snapd-default-image.patch: Fix snapd failed to", " notify bug when only the default image was used. (LP: #2147129)", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147129 ], "author": "Simon Johnsson ", "date": "Tue, 07 Apr 2026 10:14:35 +0200" }, { "cves": [], "log": [ "", " * New upstream version (LP: #2146332)", " * Drop patches merged upstream.", " * Merge with Debian unstable. Remaining changes:", " - d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch: Make fwupdmgr", " verify snapd recovery key through prompt on updates affecting FDE.", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146332 ], "author": "Mario Limonciello ", "date": "Thu, 26 Mar 2026 12:46:28 -0500" }, { "cves": [], "log": [ "", " * d/patches/dell-uod-behavior.patch: Backport from 2_0_X branch to fix", " UOD behavior for some Dell docks. (LP: #2143688)", "" ], "package": "fwupd", "version": "2.0.20-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143688 ], "author": "Mario Limonciello ", "date": "Mon, 09 Mar 2026 11:48:10 -0500" }, { "cves": [], "log": [ "", " * Enable UMA carveout feature (LP: #2142298)", " * Merge from Debian unstable. Remaining changes:", " - d/p/db-update-snapd-bad-request.patch: On TPM/FDE systems, db updates", " require notifying snapd for preparation. However, the payload uses an", " incorrect format for composite updates. Change the format to align", " with snapd.", " - d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch: Make fwupdmgr", " verify snapd recovery key through prompt on updates affecting FDE.", "" ], "package": "fwupd", "version": "2.0.20-1ubuntu1", "urgency": "low", "distributions": "resolute", "launchpad_bugs_fixed": [ 2142298 ], "author": "Mario Limonciello ", "date": "Fri, 27 Feb 2026 20:24:47 -0600" }, { "cves": [], "log": [ "", " * Fix snapd bad request on db updates (LP: #2139611):", " - d/p/db-update-snapd-bad-request.patch: On TPM/FDE systems, db updates", " require notifying snapd for preparation. However, the payload uses an", " incorrect format for composite updates. Change the format to align", " with snapd.", "" ], "package": "fwupd", "version": "2.0.19-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2139611 ], "author": "Simon Johnsson ", "date": "Mon, 23 Feb 2026 12:12:45 +0100" }, { "cves": [], "log": [ "", " * d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch: Make fwupdmgr", " verify snapd recovery key through prompt on updates affecting FDE.", " (LP: #2138609)", "" ], "package": "fwupd", "version": "2.0.19-1ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138609 ], "author": "Simon Johnsson ", "date": "Thu, 22 Jan 2026 16:38:17 +0100" } ], "notes": null, "is_version_downgrade": true }, { "name": "gir1.2-packagekitglib-1.0", "from_version": { "source_package_name": "packagekit", "source_package_version": "1.3.6-1", "version": "1.3.6-1" }, "to_version": { "source_package_name": "packagekit", "source_package_version": "1.3.6-1ubuntu1", "version": "1.3.6-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148469 ], "changes": [ { "cves": [], "log": [ "", " [ Hector Cao ]", " * d/p/lp2148469-apt-use-solve-3.0.patch: use apt solver 3.0", " (LP: #2148469)", "", " [ Alessandro Astone ]", " * d/p/pkgcli-Skip-blocked-updates-in-full-upgrade-too.patch.", " Fix `pkgcli upgrade` command after switching to apt solver 3.0, which would", " fail if some update was held back.", "" ], "package": "packagekit", "version": "1.3.6-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148469 ], "author": "Alessandro Astone ", "date": "Mon, 20 Jul 2026 13:08:28 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg-l10n", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gnupg-utils", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg-agent", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpg-wks-client", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgconf", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgsm", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgv", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.8-4ubuntu3", "version": "2.4.8-4ubuntu3" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.9-4ubuntu1", "version": "2.4.9-4ubuntu1" }, "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2154019 ], "changes": [ { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" }, { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable (LP: #2154019). Remaining changes:", " - Honor http_proxy= environment variables by default in the", " systemd user session dirmngr service", " - Don't build the gpgv-win32 package which only debian-installer", " uses", " - gnupg: Demote gnupg-l10n to Recommends", " - Demote all Recommends: gnupg to Suggests", " - Stop building gpg-wks-server, gpg-wks-client on i386", " - Demote gpg-wks-client to Recommends", " - gpg{,sm}: Recommend gpg-agent, dirmngr", " - Disable swtpm, libtss2-dev build-dep on i386", " * Drop Changes:", " - CVE-2025-68973.patch: fix memory corruption in armor parser", " [Fixed in 2.4.9-1]", " - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon", " [Fixed in 2.4.9-2]", "" ], "package": "gnupg2", "version": "2.4.9-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154019 ], "author": "Varun Varma ", "date": "Mon, 25 May 2026 18:37:47 -0400" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "gnupg2", "version": "2.4.9-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 05 Mar 2026 13:06:49 +0100" }, { "cves": [], "log": [ "", " * Update to STABLE-BRANCH-2-4 HEAD.", " * Add explicit build-dependency on libc-dev-bin. (Needed for future", " versions of dh_builtusing.) See", " https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html", "" ], "package": "gnupg2", "version": "2.4.9-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 15:30:18 +0100" }, { "cves": [ { "cve": "CVE-2026-24882", "url": "https://ubuntu.com/security/CVE-2026-24882", "cve_description": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.", "cve_priority": "medium", "cve_public_date": "2026-01-27 19:16:00 UTC" } ], "log": [ "", " [ Andreas Metzler ]", " * Update gpg.fail Debian status info.", " * Highlight/exclude minisign issues.", " * Add accelerator keys for \"Wrong\" and \"Correct\".", " Patch from uostream GIT master. (Closes: #1126259)", " * Fix stack-based buffer overflow in tpm2daemon. CVE-2026-24882 Patches", " (bugfix and regression) from upstream GIT master. (Closes: #1126631)", "", " [ Luca Boccassi ]", " * dirmngr: drop unused adduser dependency.", " None of the adduser binaries are used anymore, drop the dependency.", " The postinst that used it was removed shortly after it was", " introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4", "" ], "package": "gnupg2", "version": "2.4.9-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 15:27:53 +0100" }, { "cves": [], "log": [ "", " * new upstream release", " * refresh patches, align with FreePG 2.4 series", "" ], "package": "gnupg2", "version": "2.4.9-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Daniel Kahn Gillmor ", "date": "Tue, 30 Dec 2025 12:14:10 -0500" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " * gpg: Do not use a default when asking for another output filename.", " https://gpg.fail/filename #2", " Unfuzzed patch from GIT master", " * Write up gpg.fail status in debian/gpg.fail.md", " * agent: Fix a memory leak.", " Patch from STABLE-BRANCH-2-4", " * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.", " Replace backported patchset from master with the", " newly available one on STABLE-BRANCH-2-4.", " * Upload to experimental to avoid delaying propagation of -5 to trixie.", "" ], "package": "gnupg2", "version": "2.4.8-6", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 30 Dec 2025 15:29:50 +0100" }, { "cves": [ { "cve": "CVE-2025-68973", "url": "https://ubuntu.com/security/CVE-2025-68973", "cve_description": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "cve_priority": "high", "cve_public_date": "2025-12-28 17:16:00 UTC" } ], "log": [ "", " [ Salvatore Bonaccorso ]", " * common: Reformat some comments in iobuf.c", " * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)", " (Closes: #1124221) https://gpg.fail/memcpy #5", "", " [ Andreas Metzler ]", " * Avoid potential downgrade to SHA1 in 3rd party key signatures.", " https://gpg.fail/sha1 #12", " Patch from STABLE-BRANCH-2-4", " * gpg: Error out on unverified output for non-detached signatures.", " https://gpg.fail/detached #1", " Patch from STABLE-BRANCH-2-4", "" ], "package": "gnupg2", "version": "2.4.8-5", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Mon, 29 Dec 2025 18:03:49 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "grub-efi-riscv64", "from_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2", "version": "2.14-2ubuntu2" }, "to_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu3", "version": "2.14-2ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2156423 ], "changes": [ { "cves": [], "log": [ "", " * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)", "" ], "package": "grub2", "version": "2.14-2ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2156423 ], "author": "Mate Kukri ", "date": "Wed, 01 Jul 2026 10:39:34 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "grub-efi-riscv64-bin", "from_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2", "version": "2.14-2ubuntu2" }, "to_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu3", "version": "2.14-2ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2156423 ], "changes": [ { "cves": [], "log": [ "", " * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)", "" ], "package": "grub2", "version": "2.14-2ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2156423 ], "author": "Mate Kukri ", "date": "Wed, 01 Jul 2026 10:39:34 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "grub-efi-riscv64-unsigned", "from_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2", "version": "2.14-2ubuntu2" }, "to_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu3", "version": "2.14-2ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2156423 ], "changes": [ { "cves": [], "log": [ "", " * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)", "" ], "package": "grub2", "version": "2.14-2ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2156423 ], "author": "Mate Kukri ", "date": "Wed, 01 Jul 2026 10:39:34 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "grub2-common", "from_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu2", "version": "2.14-2ubuntu2" }, "to_version": { "source_package_name": "grub2", "source_package_version": "2.14-2ubuntu3", "version": "2.14-2ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2156423 ], "changes": [ { "cves": [], "log": [ "", " * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)", "" ], "package": "grub2", "version": "2.14-2ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2156423 ], "author": "Mate Kukri ", "date": "Wed, 01 Jul 2026 10:39:34 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "htop", "from_version": { "source_package_name": "htop", "source_package_version": "3.5.1-3", "version": "3.5.1-3" }, "to_version": { "source_package_name": "htop", "source_package_version": "3.5.2-1", "version": "3.5.2-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream release", " * Add Netlink socket libs to suggests, needed for delay accounting columns", " * Mention individual commit / patch authors in d/changelog", "" ], "package": "htop", "version": "3.5.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Daniel Lange ", "date": "Sat, 18 Jul 2026 17:30:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ieee-data", "from_version": { "source_package_name": "ieee-data", "source_package_version": "20240722build1", "version": "20240722build1" }, "to_version": { "source_package_name": "ieee-data", "source_package_version": "20260625", "version": "20260625" }, "cves": [], "launchpad_bugs_fixed": [ 2132257 ], "changes": [ { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "ieee-data", "version": "20240722build1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Sat, 06 Dec 2025 11:12:06 +0100" } ], "notes": null, "is_version_downgrade": true }, { "name": "keyboard-configuration", "from_version": { "source_package_name": "console-setup", "source_package_version": "1.237ubuntu3", "version": "1.237ubuntu3" }, "to_version": { "source_package_name": "console-setup", "source_package_version": "1.248ubuntu2", "version": "1.248ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2158626, 2153292 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix separation of primary udeb and noudeb build target", " (LP: #2158626)", "" ], "package": "console-setup", "version": "1.248ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158626 ], "author": "Nick Rosbrook ", "date": "Mon, 29 Jun 2026 11:00:13 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153292). Remaining changes:", " - debian/clean: Delete Keyboard/tree-keymaps/ on clean", " - Add an apport hook", " - debian/control: Build depend on keymapper", " - Make COPYRIGHT a symlink to debian/copyright", " - debian/vtrgb, debian/vtrgb.vga,", " debian/console-setup-linux.setvtrgb.service, debian/rules,", " debian/console-setup-linux.{postinst, prerm}: use Ubuntu's virtual", " terminal color scheme by default, with a VGA color scheme available", " as an alternative.", " - Set keymap and font in the initramfs if possible and sensible", " - Include pc105.tree for ubiquity", " - Add Keyboard/Makefile rule to build pc105.tree", " - Keyboard/keymaptree tool to analyze key maps", " - Keyboard/Makefile: make sure KeyboardNames.pl is built with accurate data from xkb-data.", " - Generate a locale locally for translating keyboard names in kbdnames-maker.", " - Make sure we give a meaningful name to ch layouts: \"Switzerland\"", " instead of \"German (Switzerland), since it includes French too.\"", " - xmlreader: Added model entry to skip model selection", " - Do not set default FONTFACE or FONTSIZE for Lat15, kernel has built-in", " Terminus font, at multitiple sizes, and it correctly selects low/high", " dpi font size, based on screen resolution. (LP 1880266)", " - If the locale is C during configuration, only set CHARMAP to", " ISO-8859-15 on kFreeBSD; otherwise restore the previous behaviour", " from before the kFreeBSD port of using UTF-8 in that case.", " - Handle unattended upgrades without breaking plymouth when updating", " console fonts.", " - setupcon:", " + Explicitly exit 0, so that postinsts don't fail in the event that", " loadkeys can't find a console.", " + Map XKBMODEL=SKIP to '' for compatibility with existing", " configs.", " + handle compressed console maps and font files", " + the system should not have to resolve filenames to find the keymap", " cache on boot.", " - Added templates for keyboard detection", " - debian/keyboard-configuration.config:", " + Map ppc64el/* to XKBMODEL=pc105", " + Set default for Dutch to us(intl), not just us.", " + Set default layout for Kurdish to tr(ku)", " + Set default layout for Vietnam to 'us'", " + change back the french default layout to be fr+oss and not fr+latin9", " + Drop the xkb-keymap bits once again as we're not ready for those yet,", " as it's currently causing an invalid default layout in the installer.", " + keyboard-configuration.{config,templates}: There is no good default", " for layout toggling, stop pretending there is. Console users can set", " one with dpkg-reconfigure or editing /etc/defaults/keyboard", " + nicola_f_bs quirk", " + quirk for Montenegro", " + While sourcing config files to re-seed debconf,", " treat missing XKBOPTIONS as empty. (LP 1762952)", " + If the detect-keyboard debconf plugin is available", " (cdebconf-newt-detect-keys in the installer), then offer to use it to", " detect the keyboard layout.", " + Fix default keyboard selection for language/country combinations lacking", " a proper combined locale (LP 814448).", " * Dropped changes, included in Debian:", " - Keyboard/kbdcompiler: Fix checking ckbcomp success.", " - Keyboard/ckbcomp: Support symbols = [...].", " - keyboard_present.sh: Quiet config/postinst when we have no USB devices", " * Dropped changes, no longer needed:", " - Tolerate absence of setupcon in postinst scripts. Should be fixed by", " refactoring to not have a keyboard-configuration package that needs", " to call setupcon without depending on it.", " - Call setupcon --force only when debian-installer is active", " and always redirect output to /dev/null to not block. (LP: 520546)", " - Fix command injection in ckbcomp", " - Don't copy keyboard-configuration questions to /target in OEM mode.", " oem-config will ask them later, and copying these confuses it.", " - debian/preprocessor: revert the removal of keyboard names (for size) of", " console-setup-udeb: we do need those, since we don't use the simplified", " xkb-keymap template from Debian just yet: this way we can still show", " country/language names when selecting a keyboard, layout or variant", " - Drop several commented out portions of debian/rules related to udeb", " - Drop removal of di-gzipped-ekmaps, which are only used for udebs", " * Dropped several changes that were not explicitly documented in the", " changelog, and are no longer needed:", " - Drop console-setup-pc-ekbd from debian/control", " - Drop Depends: cdebconf-newt-detect-keys", " - Drop udeb portion of vtrgb delta", " * New changes:", " - d/rules: skip udeb rules if building with noudeb profile", "" ], "package": "console-setup", "version": "1.248ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153292 ], "author": "Nick Rosbrook ", "date": "Wed, 17 Jun 2026 13:32:36 -0400" }, { "cves": [], "log": [ "", " * Team upload", "", " [ Samuel Thibault ]", " * control: Use binary:Version instead of source:Version so it can be", " binnmu'd.", "", " [ Updated translations ]", " * Bengali (bn.po) by Khan Sunny", " * Bosnian (bs.po) by pacavarn", " * Galician (gl.po) by HackingAll", " * Lao (lo.po) by BoneNI", " * Occitan (oc.po) by Quentin PAGÈS", " * Swedish (sv.po) by bittin1ddc447d824349b2", " * Tamil (ta.po) by தமிழ்நேரம்", " * Tajik (tg.po) by Victor Ibragimov", " * Traditional Chinese (zh_TW.po) by macylin", "" ], "package": "console-setup", "version": "1.248", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Thu, 14 May 2026 13:44:25 +0200" }, { "cves": [], "log": [ "", " * Rebuild against xkb-data 2.47-1.", "" ], "package": "console-setup", "version": "1.247", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Mon, 30 Mar 2026 21:30:08 +0200" }, { "cves": [], "log": [ "", " * Team upload", "", " * Add missing changelog entry for 1.245 (MR!26).", "", " [ Updated translations ]", " * Bengali (bn.po) by emma peel", " * German (de.po) by Holger Wansing", " * Spanish (es.po) by emma peel", " * Estonian (et.po) by Priit Jõerüüt", " * Galician (gl.po) by HackingAll", " * Kazakh (kk.po) by Baurzhan Muftakhidinov", " * Kannada (kn.po) by Prasannakumar T Bhat", " * Korean (ko.po) by Changwoo Ryu", " * Punjabi (Gurmukhi) (pa.po) by Aman Alam", " * Portuguese (pt.po) by Miguel Figueiredo", " * Russian (ru.po) by Effently", "" ], "package": "console-setup", "version": "1.246", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Mon, 02 Mar 2026 21:04:43 +0100" }, { "cves": [], "log": [ "", " [ Samuel Thibault ]", " * Upload against newer xkb-data (Closes: #1122650)", " * Keyboard/kbdcompiler: Fix checking ckbcomp success.", " * Keyboard/ckbcomp: Support symbols = [...].", "", " [ Daniel Lewart ]", " * Fix runtime errors (closes: #968122)", "" ], "package": "console-setup", "version": "1.245", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Sat, 20 Dec 2025 02:20:42 +0100" }, { "cves": [], "log": [ "", " [ D-I role ]", " * [l10n] Commit changed/added po files (from l10n-sync run at dillon)", "", " [ Philip Hands ]", " * lintian: override depends-on-essential hurd", " * setupcon: use a fixed name for the initrd keymap file (closes: #977877)", "" ], "package": "console-setup", "version": "1.244", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Philip Hands ", "date": "Sun, 26 Oct 2025 08:52:50 +0100" }, { "cves": [], "log": [ "", " [ Holger Wansing ]", " * Change d/copyright and d/bdf2psf.copyright, to remove FSF's (outdated)", " postal address.", "", " [ Samuel Thibault ]", " * keyboard-configuration.templates: Add Left Alt+Left Shift choice for group", " toggle, set as default to avoid conflict with level3(ralt_switch)", " (Closes: #1117976).", " * keyboard-configuration.config: Manage Left Alt+Left Shift, make Alt+Shift", " allocate both left and right alt.", " * keyboard-configuration.preinst: Automatically migrate to Left Alt+Left", " Shift.", " * CHANGES: remove duplicate file.", " * keyboard-configuration.templates: Fix dz(azerty-oss/deadkeys) into dz,", " which is what xkb really provides.", " * keyboard-configuration.config: Fix dz default layout.", "" ], "package": "console-setup", "version": "1.243", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Sun, 19 Oct 2025 16:03:57 +0200" }, { "cves": [], "log": [ "", " * keyboard-configuration.templates: Update dz(la) into dz(azerty-oss).", " * rules: Check that d-i's kmaps have all the d-i layouts.", "" ], "package": "console-setup", "version": "1.242", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Fri, 29 Aug 2025 18:13:24 +0200" }, { "cves": [], "log": [ "", " * keyboard-configuration.templates: Use ca/multix variant instead of", " ca/multi (Closes: #1111994).", "" ], "package": "console-setup", "version": "1.241", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Thibault ", "date": "Fri, 29 Aug 2025 01:11:18 +0200" }, { "cves": [], "log": [ "", " [ Updated translations ]", " * Spanish (es.po) by Santiago Vila", " * Russian (ru.po) by Алексей Шилин", " * Tamil (ta.po) by தமிழ்நேரம்", "" ], "package": "console-setup", "version": "1.240", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Cyril Brulebois ", "date": "Sun, 20 Jul 2025 06:30:07 +0200" }, { "cves": [], "log": [ "", " [ NoisyCoil ]", " * Add support for Apple MTP keyboard and Apple SPI Keyboard, as found", " on ARM-based Apple laptops like M1 MacBook Pro and M2 MacBook Air", " (Closes: #1108360).", "" ], "package": "console-setup", "version": "1.239", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Cyril Brulebois ", "date": "Fri, 27 Jun 2025 17:20:08 +0200" }, { "cves": [], "log": [ "", " * Team upload", "", " [ Updated translations ]", " * Belarusian (be.po) by Joe", " * Greek (el.po) by galaxico", " * Hungarian (hu.po) by Szia Tomi", " * Khmer (km.po) by Chou Chamnan", " * Punjabi (Gurmukhi) (pa.po) by DuskyElf", " * Romanian (ro.po) by Remus-Gabriel Chelu", " * Russian (ru.po) by vladiruzz", " * Sinhala (si.po) by leela", " * Telugu (te.po) by Sripath Roy Koganti", " * Uyghur (ug.po) by Abduqadir Abliz", " * Traditional Chinese (zh_TW.po) by reimu105", "" ], "package": "console-setup", "version": "1.238", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Holger Wansing ", "date": "Tue, 24 Jun 2025 23:11:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libappstream5:riscv64", "from_version": { "source_package_name": "appstream", "source_package_version": "1.1.2-1", "version": "1.1.2-1" }, "to_version": { "source_package_name": "appstream", "source_package_version": "1.1.3-1", "version": "1.1.3-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version: 1.1.3", " * Bump standards version: No changes needed", "" ], "package": "appstream", "version": "1.1.3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klumpp ", "date": "Thu, 18 Jun 2026 20:04:56 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libattr1:riscv64", "from_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-4", "version": "1:2.5.2-4" }, "to_version": { "source_package_name": "attr", "source_package_version": "1:2.6.0-1", "version": "1:2.6.0-1" }, "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "log": [ "", " * New upstream release.", " - Refresh local patches.", " - Remove upstream patches included in this release.", " - Update upstream OpenPGP signing certificates.", " - Fix symlink traversal vulnerability [CVE-2026-54371]. Closes: #1141107", " * Remove build dependency on debhelper (>= 13.10) implied by", " debhelper-compat (= 13) since Debian bookworm.", " * Remove build dependencies on automake, autoconf and libtool implied", " by debhelper-compat (>= 10) since Debian stretch.", " * Switch to Standards-Version 4.7.4 (no changes needed).", " * Refactor common synopsis into a source stanza Description field.", " * Improve and clarify package descriptions.", " * Switch debian/watch URL to use the one not affected by mirroring,", " as that has delays of up to a day.", "" ], "package": "attr", "version": "1:2.6.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Guillem Jover ", "date": "Mon, 29 Jun 2026 23:34:26 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-crypto3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-fs3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-loop3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-mdraid3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-nvme3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-part3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-smart3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-swap3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev-utils3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblockdev3:riscv64", "from_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-1", "version": "3.5.0-1" }, "to_version": { "source_package_name": "libblockdev", "source_package_version": "3.5.0-2", "version": "3.5.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Adjust to changes in exfatprogs >= 1.4.0 (Closes: #1141108)", "" ], "package": "libblockdev", "version": "3.5.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:09:31 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbytesize-common", "from_version": { "source_package_name": "libbytesize", "source_package_version": "2.12-1", "version": "2.12-1" }, "to_version": { "source_package_name": "libbytesize", "source_package_version": "2.12-2", "version": "2.12-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * Update debhelper-compat to 14", " * Bump Standards-Version to 4.7.4", "" ], "package": "libbytesize", "version": "2.12-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Thu, 02 Jul 2026 23:37:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbytesize1:riscv64", "from_version": { "source_package_name": "libbytesize", "source_package_version": "2.12-1", "version": "2.12-1" }, "to_version": { "source_package_name": "libbytesize", "source_package_version": "2.12-2", "version": "2.12-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * Update debhelper-compat to 14", " * Bump Standards-Version to 4.7.4", "" ], "package": "libbytesize", "version": "2.12-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Thu, 02 Jul 2026 23:37:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcom-err2:riscv64", "from_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.2-3ubuntu4", "version": "1.47.2-3ubuntu4" }, "to_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.4-1", "version": "1.47.4-1" }, "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "launchpad_bugs_fixed": [ 2138219, 2132257, 2025339, 1939409, 1817097 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix pkgconfig call that results in inability", " to find udev rules.d in dh_install. Patch supplied by", " Helmut Grohne in Debian bug 1126636. (LP: #2138219)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu4", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138219 ], "author": "John Chittum ", "date": "Fri, 13 Feb 2026 07:17:00 -0500" }, { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Mon, 02 Feb 2026 21:34:31 +0100" }, { "cves": [], "log": [ "", " * Rebuild to include updated RISC-V base ISA RVA23", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Wed, 03 Sep 2025 17:46:20 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu1", "urgency": "low", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Thu, 12 Jun 2025 15:13:43 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-1ubuntu1", "urgency": "low", "distributions": "plucky", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 07 Jan 2025 21:26:01 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.1-1ubuntu1", "urgency": "low", "distributions": "oracular", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 25 Jun 2024 11:33:08 +0200" }, { "cves": [], "log": [ "", " * No change rebuild against libfuse2t64.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu4", "urgency": "high", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 08 Apr 2024 16:38:40 +0200" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 07:33:00 +0000" }, { "cves": [], "log": [ "", " * Make the provides for the renamed packages versioned.", " * Break against the first version not building the t64 packages anymore.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Tue, 12 Mar 2024 21:22:45 +0100" }, { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Tue, 12 Mar 2024 11:31:16 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.3ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 04 Mar 2024 08:18:05 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian Unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Wed, 26 Jul 2023 13:26:17 -0500" }, { "cves": [], "log": [ "", " * Temporarily disable orphan_file by default, such that fsck from jammy", " can check ext4 created in mantic. Given the new incompat ext4 features", " that v5.15 & hwe kernels support, ideally e2fsprogs 1.47.0 should be", " SRUed into jammy. LP: #2025339", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu2", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [ 2025339 ], "author": "Dimitri John Ledkov ", "date": "Thu, 29 Jun 2023 10:14:32 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Disable the metadata_csum_seed feature again, as grub does not yet", " support it (Closes: #866603)", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu1", "urgency": "low", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 17 Feb 2023 11:58:55 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes (applied in Debian):", " - 0001-tests-support-older-versions-of-timeout-in-r_corrupt", " - CVE-2022-1304.patch", "" ], "package": "e2fsprogs", "version": "1.46.6~rc1-1ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Tue, 22 Nov 2022 15:15:27 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds read/write vulnerability", " Issue leads to segmentation fault and possibly arbitrary code", " execution via a specially crafted filesystem.", " - debian/patches/CVE-2022-1304.patch: checks that all leaf nodes of", " file system contain at least one extent.", " - CVE-2022-1304", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu2", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Mark Esler ", "date": "Thu, 02 Jun 2022 22:03:15 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 08 Jan 2022 21:02:36 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 01 Jan 2022 22:41:06 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.4-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Wed, 03 Nov 2021 09:32:13 +0100" }, { "cves": [], "log": [ "", " * Restore mke2fs capability to create files adding patch", "", " - mke2fs: fix creating a file system image w/o a pre-existing file", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu3", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Mon, 30 Aug 2021 17:58:29 +0200" }, { "cves": [], "log": [ "", " * Fix failing tests on bigendian system (LP: #1939409)", " using upstream patches queued for 1.46.4:", "", " - e2fsck: fix f_baddotdir failure on big-endian systems", " - libext2fs: fix translation of Posix ACL's on big-endian systems", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1939409 ], "author": "Heinrich Schuchardt ", "date": "Wed, 11 Aug 2021 19:04:33 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian experimental. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Tue, 10 Aug 2021 10:07:26 +0200" }, { "cves": [], "log": [ "", " * Apply upstream fix for unaligned memory access.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 27 May 2021 13:20:34 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 10 May 2021 14:31:18 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to drop the udeb package.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu2", "urgency": "medium", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 22 Feb 2021 10:30:51 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu1", "urgency": "low", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 29 Jan 2021 12:37:12 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.6-1ubuntu1", "urgency": "low", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 01 May 2020 14:47:58 -0700" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes, included upstream:", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", "" ], "package": "e2fsprogs", "version": "1.45.5-2ubuntu1", "urgency": "low", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2020 22:08:18 -0800" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - CVE-2019-5188", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Wed, 22 Jan 2020 12:01:15 -0300" }, { "cves": [ { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write on the heap", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", " - CVE-2019-5094", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu2", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Mon, 30 Sep 2019 14:57:59 -0300" }, { "cves": [], "log": [ "", " * Merge with Debian testing, remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Adam Conrad ", "date": "Sun, 08 Sep 2019 04:12:08 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size.", "" ], "package": "e2fsprogs", "version": "1.45.2-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 24 Jun 2019 11:51:53 +0200" }, { "cves": [], "log": [ "", " * Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size. LP: #1817097", "" ], "package": "e2fsprogs", "version": "1.45.1-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [ 1817097 ], "author": "Dimitri John Ledkov ", "date": "Wed, 15 May 2019 16:15:22 +0200" } ], "notes": null, "is_version_downgrade": true }, { "name": "libcurl3t64-gnutls:riscv64", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2", "version": "8.18.0-1ubuntu2" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu1", "version": "8.20.0-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "launchpad_bugs_fixed": [ 2153275 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153275). Remaining changes:", " - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe", " - d/control: don't build-depend on python3-impacket and stunnel on i386", " * Dropped delta removed earlier:", " - d/control: do not use gnutls for the curl binary", " [Dropped in 8.13.0-2]", "" ], "package": "curl", "version": "8.20.0-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153275 ], "author": "Ural Tunaboyu ", "date": "Fri, 29 May 2026 09:10:13 -0700" }, { "cves": [], "log": [ "", " * debian/patches/event-fix-wakeup-consumption.patch: cherry-pick from", " upstream. (Closes: #1136378, #1136264)", "" ], "package": "curl", "version": "8.20.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 13 May 2026 11:15:17 +0200" }, { "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe", " - d/control: do not use gnutls for the curl binary", " - d/control: don't build-depend on python3-impacket and stunnel on i386", " * Dropped changes:", " - SECURITY UPDATE: bad reuse of HTTP Negotiate connection", " + debian/patches/CVE-2026-1965-1.patch: fix reuse of connections using", " HTTP Negotiate in lib/url.c.", " + debian/patches/CVE-2026-1965-2.patch: fix copy and paste", " url_match_auth_nego mistake in lib/url.c.", " + CVE-2026-1965", " - SECURITY UPDATE: token leak with redirect and netrc", " + debian/patches/CVE-2026-3783.patch: only send bearer if auth is", " allowed in lib/http.c, tests/data/Makefile.am, tests/data/test2006.", " + CVE-2026-3783", " - SECURITY UPDATE: wrong proxy connection reuse with credentials", " + debian/patches/CVE-2026-3784.patch: add additional tests in", " lib/url.c, tests/http/test_13_proxy_auth.py,", " tests/http/testenv/curl.py.", " + CVE-2026-3784", " - SECURITY UPDATE: use after free in SMB connection reuse", " + debian/patches/CVE-2026-3805.patch: free the path in the request", " struct properly in lib/smb.c.", " + CVE-2026-3805", " - SECURITY UPDATE: connection reuse ignores TLS requirement", " + debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls", " connection if new requires TLS in lib/url.c.", " + CVE-2026-4873", " - SECURITY UPDATE: wrong reuse of HTTP Negotiate connection", " + debian/patches/CVE-2026-5545.patch: improve connection reuse on", " negotiate in lib/url.c.", " + CVE-2026-5545", " - SECURITY UPDATE: wrong reuse of SMB connection", " + debian/patches/CVE-2026-5773.patch: disable connection reuse for", " SMB(S) in lib/smb.c.", " + CVE-2026-5773", " - SECURITY UPDATE: proxy credentials leak over redirect-to proxy", " + debian/patches/CVE-2026-6253-pre1.patch: chunked response, error code", " in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c, tests/*.", " + debian/patches/CVE-2026-6253-pre2.patch: fix error code, remove SMB", " use in tests/data/test445.", " + debian/patches/CVE-2026-6253.patch: clear the proxy credentials as", " well on port or scheme change in lib/http.c, lib/transfer.*, tests/*.", " + CVE-2026-6253", " - SECURITY UPDATE: stale custom cookie host causes cookie leak", " + debian/patches/CVE-2026-6276.patch: move cookiehost to struct", " SingleRequest in lib/http.c, lib/request.c, lib/request.h, lib/url.c,", " lib/urldata.h, tests/*.", " + CVE-2026-6276", " - SECURITY UPDATE: netrc credential leak with reused proxy connection", " + debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes", " pushed over insecure connections in lib/http2.c.", " + debian/patches/CVE-2026-6429-pre2.patch: same origin tests in", " lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.", " + debian/patches/CVE-2026-6429.patch: clear credentials better on", " redirect in lib/http.c, tests/*.", " + CVE-2026-6429", " - SECURITY UPDATE: cross-proxy Digest auth state leak", " + debian/patches/CVE-2026-7168.patch: clear proxy auth properties when", " switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.", " + CVE-2026-7168", "" ], "package": "curl", "version": "8.20.0-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Tue, 05 May 2026 07:20:49 -0500" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0", "" ], "package": "curl", "version": "8.20.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Wed, 29 Apr 2026 11:38:11 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0~rc3", "" ], "package": "curl", "version": "8.20.0~rc3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Thu, 23 Apr 2026 07:44:08 -0700" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0~rc2", "", " [ Samuel Henrique ]", " * Bump Standards-Version to 4.7.4.", " * debian/copyright: Remove files from rtmp support, dropped upstream.", "", " [ Carlos Henrique Lima Melara ]", " * debian/patches: refresh patches.", " - test459-switch-to-mode-warn-for-stderr-check.patch: drop patch merged", " upstream.", "", "" ], "package": "curl", "version": "8.20.0~rc2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Tue, 14 Apr 2026 22:22:42 -0300" }, { "cves": [], "log": [ "", " * debian/rules: revert parallel tests multiplier to 4.", "" ], "package": "curl", "version": "8.19.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Thu, 26 Mar 2026 22:28:12 -0300" }, { "cves": [], "log": [ "", " [ Samuel Henrique ]", " * debian/rules: Don't skip any tests and increase parallel factor to 7.", "", " [ Carlos Henrique Lima Melara ]", " * debian/patches/test459-switch-to-mode-warn-for-stderr-check.patch:", " cherry-pick from upstream. (Closes: #1131157)", "" ], "package": "curl", "version": "8.19.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Thu, 26 Mar 2026 21:16:48 -0300" }, { "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" } ], "log": [ "", " * New upstream version 8.19.0.", " - Fix CVE-2026-1965, CVE-2026-3783, CVE-2026-3784 and CVE-2026-3805.", " * debian/control: drop leftover quilt build-dep. (Closes: #1129269)", "" ], "package": "curl", "version": "8.19.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 11 Mar 2026 19:40:54 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.19.0~rc3.", " * debian/patches: refresh patches.", " - revert-to-recursive-macros.patch: drop, in the release.", "" ], "package": "curl", "version": "8.19.0~rc3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Fri, 27 Feb 2026 19:06:29 -0300" }, { "cves": [], "log": [ "", " * debian/patches/revert-to-recursive-macros.patch: cherry-pick from", " upstream. (Closes: #1128884)", "" ], "package": "curl", "version": "8.19.0~rc2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Mon, 23 Feb 2026 21:12:59 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.19.0~rc2", " * Refresh patches", " * d/copyright: Drop removed files", "" ], "package": "curl", "version": "8.19.0~rc2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Sat, 21 Feb 2026 09:44:52 -0800" }, { "cves": [], "log": [ "", " [ Simon McVittie ]", " * debian/rules: Replace LDFLAGS in curl-config(1) for multiarch", " co-installability. (Closes: #1124987)", "" ], "package": "curl", "version": "8.18.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 14 Jan 2026 23:10:10 -0300" }, { "cves": [ { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: connection reuse ignores TLS requirement", " - debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls", " connection if new requires TLS in lib/url.c.", " - CVE-2026-4873", " * SECURITY UPDATE: wrong reuse of HTTP Negotiate connection", " - debian/patches/CVE-2026-5545.patch: improve connection reuse on", " negotiate in lib/url.c.", " - CVE-2026-5545", " * SECURITY UPDATE: wrong reuse of SMB connection", " - debian/patches/CVE-2026-5773.patch: disable connection reuse for", " SMB(S) in lib/smb.c.", " - CVE-2026-5773", " * SECURITY UPDATE: proxy credentials leak over redirect-to proxy", " - debian/patches/CVE-2026-6253-pre1.patch: chunked response, error code", " in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c, tests/*.", " - debian/patches/CVE-2026-6253-pre2.patch: fix error code, remove SMB", " use in tests/data/test445.", " - debian/patches/CVE-2026-6253.patch: clear the proxy credentials as", " well on port or scheme change in lib/http.c, lib/transfer.*, tests/*.", " - CVE-2026-6253", " * SECURITY UPDATE: stale custom cookie host causes cookie leak", " - debian/patches/CVE-2026-6276.patch: move cookiehost to struct", " SingleRequest in lib/http.c, lib/request.c, lib/request.h, lib/url.c,", " lib/urldata.h, tests/*.", " - CVE-2026-6276", " * SECURITY UPDATE: netrc credential leak with reused proxy connection", " - debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes", " pushed over insecure connections in lib/http2.c.", " - debian/patches/CVE-2026-6429-pre2.patch: same origin tests in", " lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.", " - debian/patches/CVE-2026-6429.patch: clear credentials better on", " redirect in lib/http.c, tests/*.", " - CVE-2026-6429", " * SECURITY UPDATE: cross-proxy Digest auth state leak", " - debian/patches/CVE-2026-7168.patch: clear proxy auth properties when", " switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.", " - CVE-2026-7168", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 29 Apr 2026 07:35:43 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4t64:riscv64", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2", "version": "8.18.0-1ubuntu2" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu1", "version": "8.20.0-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "launchpad_bugs_fixed": [ 2153275 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153275). Remaining changes:", " - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe", " - d/control: don't build-depend on python3-impacket and stunnel on i386", " * Dropped delta removed earlier:", " - d/control: do not use gnutls for the curl binary", " [Dropped in 8.13.0-2]", "" ], "package": "curl", "version": "8.20.0-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153275 ], "author": "Ural Tunaboyu ", "date": "Fri, 29 May 2026 09:10:13 -0700" }, { "cves": [], "log": [ "", " * debian/patches/event-fix-wakeup-consumption.patch: cherry-pick from", " upstream. (Closes: #1136378, #1136264)", "" ], "package": "curl", "version": "8.20.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 13 May 2026 11:15:17 +0200" }, { "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe", " - d/control: do not use gnutls for the curl binary", " - d/control: don't build-depend on python3-impacket and stunnel on i386", " * Dropped changes:", " - SECURITY UPDATE: bad reuse of HTTP Negotiate connection", " + debian/patches/CVE-2026-1965-1.patch: fix reuse of connections using", " HTTP Negotiate in lib/url.c.", " + debian/patches/CVE-2026-1965-2.patch: fix copy and paste", " url_match_auth_nego mistake in lib/url.c.", " + CVE-2026-1965", " - SECURITY UPDATE: token leak with redirect and netrc", " + debian/patches/CVE-2026-3783.patch: only send bearer if auth is", " allowed in lib/http.c, tests/data/Makefile.am, tests/data/test2006.", " + CVE-2026-3783", " - SECURITY UPDATE: wrong proxy connection reuse with credentials", " + debian/patches/CVE-2026-3784.patch: add additional tests in", " lib/url.c, tests/http/test_13_proxy_auth.py,", " tests/http/testenv/curl.py.", " + CVE-2026-3784", " - SECURITY UPDATE: use after free in SMB connection reuse", " + debian/patches/CVE-2026-3805.patch: free the path in the request", " struct properly in lib/smb.c.", " + CVE-2026-3805", " - SECURITY UPDATE: connection reuse ignores TLS requirement", " + debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls", " connection if new requires TLS in lib/url.c.", " + CVE-2026-4873", " - SECURITY UPDATE: wrong reuse of HTTP Negotiate connection", " + debian/patches/CVE-2026-5545.patch: improve connection reuse on", " negotiate in lib/url.c.", " + CVE-2026-5545", " - SECURITY UPDATE: wrong reuse of SMB connection", " + debian/patches/CVE-2026-5773.patch: disable connection reuse for", " SMB(S) in lib/smb.c.", " + CVE-2026-5773", " - SECURITY UPDATE: proxy credentials leak over redirect-to proxy", " + debian/patches/CVE-2026-6253-pre1.patch: chunked response, error code", " in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c, tests/*.", " + debian/patches/CVE-2026-6253-pre2.patch: fix error code, remove SMB", " use in tests/data/test445.", " + debian/patches/CVE-2026-6253.patch: clear the proxy credentials as", " well on port or scheme change in lib/http.c, lib/transfer.*, tests/*.", " + CVE-2026-6253", " - SECURITY UPDATE: stale custom cookie host causes cookie leak", " + debian/patches/CVE-2026-6276.patch: move cookiehost to struct", " SingleRequest in lib/http.c, lib/request.c, lib/request.h, lib/url.c,", " lib/urldata.h, tests/*.", " + CVE-2026-6276", " - SECURITY UPDATE: netrc credential leak with reused proxy connection", " + debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes", " pushed over insecure connections in lib/http2.c.", " + debian/patches/CVE-2026-6429-pre2.patch: same origin tests in", " lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.", " + debian/patches/CVE-2026-6429.patch: clear credentials better on", " redirect in lib/http.c, tests/*.", " + CVE-2026-6429", " - SECURITY UPDATE: cross-proxy Digest auth state leak", " + debian/patches/CVE-2026-7168.patch: clear proxy auth properties when", " switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.", " + CVE-2026-7168", "" ], "package": "curl", "version": "8.20.0-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Tue, 05 May 2026 07:20:49 -0500" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0", "" ], "package": "curl", "version": "8.20.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Wed, 29 Apr 2026 11:38:11 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0~rc3", "" ], "package": "curl", "version": "8.20.0~rc3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Thu, 23 Apr 2026 07:44:08 -0700" }, { "cves": [], "log": [ "", " * New upstream version 8.20.0~rc2", "", " [ Samuel Henrique ]", " * Bump Standards-Version to 4.7.4.", " * debian/copyright: Remove files from rtmp support, dropped upstream.", "", " [ Carlos Henrique Lima Melara ]", " * debian/patches: refresh patches.", " - test459-switch-to-mode-warn-for-stderr-check.patch: drop patch merged", " upstream.", "", "" ], "package": "curl", "version": "8.20.0~rc2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Tue, 14 Apr 2026 22:22:42 -0300" }, { "cves": [], "log": [ "", " * debian/rules: revert parallel tests multiplier to 4.", "" ], "package": "curl", "version": "8.19.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Thu, 26 Mar 2026 22:28:12 -0300" }, { "cves": [], "log": [ "", " [ Samuel Henrique ]", " * debian/rules: Don't skip any tests and increase parallel factor to 7.", "", " [ Carlos Henrique Lima Melara ]", " * debian/patches/test459-switch-to-mode-warn-for-stderr-check.patch:", " cherry-pick from upstream. (Closes: #1131157)", "" ], "package": "curl", "version": "8.19.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Thu, 26 Mar 2026 21:16:48 -0300" }, { "cves": [ { "cve": "CVE-2026-1965", "url": "https://ubuntu.com/security/CVE-2026-1965", "cve_description": "libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:15:00 UTC" }, { "cve": "CVE-2026-3783", "url": "https://ubuntu.com/security/CVE-2026-3783", "cve_description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3784", "url": "https://ubuntu.com/security/CVE-2026-3784", "cve_description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.", "cve_priority": "low", "cve_public_date": "2026-03-11 11:16:00 UTC" }, { "cve": "CVE-2026-3805", "url": "https://ubuntu.com/security/CVE-2026-3805", "cve_description": "When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.", "cve_priority": "medium", "cve_public_date": "2026-03-11 11:16:00 UTC" } ], "log": [ "", " * New upstream version 8.19.0.", " - Fix CVE-2026-1965, CVE-2026-3783, CVE-2026-3784 and CVE-2026-3805.", " * debian/control: drop leftover quilt build-dep. (Closes: #1129269)", "" ], "package": "curl", "version": "8.19.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 11 Mar 2026 19:40:54 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.19.0~rc3.", " * debian/patches: refresh patches.", " - revert-to-recursive-macros.patch: drop, in the release.", "" ], "package": "curl", "version": "8.19.0~rc3-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Fri, 27 Feb 2026 19:06:29 -0300" }, { "cves": [], "log": [ "", " * debian/patches/revert-to-recursive-macros.patch: cherry-pick from", " upstream. (Closes: #1128884)", "" ], "package": "curl", "version": "8.19.0~rc2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Mon, 23 Feb 2026 21:12:59 -0300" }, { "cves": [], "log": [ "", " * New upstream version 8.19.0~rc2", " * Refresh patches", " * d/copyright: Drop removed files", "" ], "package": "curl", "version": "8.19.0~rc2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Sat, 21 Feb 2026 09:44:52 -0800" }, { "cves": [], "log": [ "", " [ Simon McVittie ]", " * debian/rules: Replace LDFLAGS in curl-config(1) for multiarch", " co-installability. (Closes: #1124987)", "" ], "package": "curl", "version": "8.18.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Carlos Henrique Lima Melara ", "date": "Wed, 14 Jan 2026 23:10:10 -0300" }, { "cves": [ { "cve": "CVE-2026-4873", "url": "https://ubuntu.com/security/CVE-2026-4873", "cve_description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5545", "url": "https://ubuntu.com/security/CVE-2026-5545", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-5773", "url": "https://ubuntu.com/security/CVE-2026-5773", "cve_description": "libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6253", "url": "https://ubuntu.com/security/CVE-2026-6253", "cve_description": "curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6276", "url": "https://ubuntu.com/security/CVE-2026-6276", "cve_description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.", "cve_priority": "low", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-7168", "url": "https://ubuntu.com/security/CVE-2026-7168", "cve_description": "Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: connection reuse ignores TLS requirement", " - debian/patches/CVE-2026-4873.patch: do not reuse a non-tls starttls", " connection if new requires TLS in lib/url.c.", " - CVE-2026-4873", " * SECURITY UPDATE: wrong reuse of HTTP Negotiate connection", " - debian/patches/CVE-2026-5545.patch: improve connection reuse on", " negotiate in lib/url.c.", " - CVE-2026-5545", " * SECURITY UPDATE: wrong reuse of SMB connection", " - debian/patches/CVE-2026-5773.patch: disable connection reuse for", " SMB(S) in lib/smb.c.", " - CVE-2026-5773", " * SECURITY UPDATE: proxy credentials leak over redirect-to proxy", " - debian/patches/CVE-2026-6253-pre1.patch: chunked response, error code", " in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c, tests/*.", " - debian/patches/CVE-2026-6253-pre2.patch: fix error code, remove SMB", " use in tests/data/test445.", " - debian/patches/CVE-2026-6253.patch: clear the proxy credentials as", " well on port or scheme change in lib/http.c, lib/transfer.*, tests/*.", " - CVE-2026-6253", " * SECURITY UPDATE: stale custom cookie host causes cookie leak", " - debian/patches/CVE-2026-6276.patch: move cookiehost to struct", " SingleRequest in lib/http.c, lib/request.c, lib/request.h, lib/url.c,", " lib/urldata.h, tests/*.", " - CVE-2026-6276", " * SECURITY UPDATE: netrc credential leak with reused proxy connection", " - debian/patches/CVE-2026-6429-pre1.patch: prevent secure schemes", " pushed over insecure connections in lib/http2.c.", " - debian/patches/CVE-2026-6429-pre2.patch: same origin tests in", " lib/http2.c, lib/urlapi-int.h, lib/urlapi.c.", " - debian/patches/CVE-2026-6429.patch: clear credentials better on", " redirect in lib/http.c, tests/*.", " - CVE-2026-6429", " * SECURITY UPDATE: cross-proxy Digest auth state leak", " - debian/patches/CVE-2026-7168.patch: clear proxy auth properties when", " switching in lib/setopt.c, lib/vauth/vauth.h, tests/*.", " - CVE-2026-7168", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 29 Apr 2026 07:35:43 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libdbus-1-3:riscv64", "from_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu1", "version": "1.16.2-5ubuntu1" }, "to_version": { "source_package_name": "dbus", "source_package_version": "1.16.2-5ubuntu2", "version": "1.16.2-5ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Stop providing default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", " * d/control: Prefer dbus-broker for the user bus", " dbus-broker will be the default user bus provider in Ubuntu. (LP: #2015538)", " * d/p/u/aa-get-connection-apparmor-security-context.patch: Drop patch.", " The GetConnectionAppArmorSecurityContext method has been deprecated since", " 2015. All its users have been ported away. (LP: #1489489)", "" ], "package": "dbus", "version": "1.16.2-5ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538, 2015538, 1489489 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 18:00:34 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libext2fs2t64:riscv64", "from_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.2-3ubuntu4", "version": "1.47.2-3ubuntu4" }, "to_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.4-1", "version": "1.47.4-1" }, "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "launchpad_bugs_fixed": [ 2138219, 2132257, 2025339, 1939409, 1817097 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix pkgconfig call that results in inability", " to find udev rules.d in dh_install. Patch supplied by", " Helmut Grohne in Debian bug 1126636. (LP: #2138219)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu4", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138219 ], "author": "John Chittum ", "date": "Fri, 13 Feb 2026 07:17:00 -0500" }, { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Mon, 02 Feb 2026 21:34:31 +0100" }, { "cves": [], "log": [ "", " * Rebuild to include updated RISC-V base ISA RVA23", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Wed, 03 Sep 2025 17:46:20 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu1", "urgency": "low", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Thu, 12 Jun 2025 15:13:43 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-1ubuntu1", "urgency": "low", "distributions": "plucky", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 07 Jan 2025 21:26:01 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.1-1ubuntu1", "urgency": "low", "distributions": "oracular", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 25 Jun 2024 11:33:08 +0200" }, { "cves": [], "log": [ "", " * No change rebuild against libfuse2t64.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu4", "urgency": "high", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 08 Apr 2024 16:38:40 +0200" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 07:33:00 +0000" }, { "cves": [], "log": [ "", " * Make the provides for the renamed packages versioned.", " * Break against the first version not building the t64 packages anymore.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Tue, 12 Mar 2024 21:22:45 +0100" }, { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Tue, 12 Mar 2024 11:31:16 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.3ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 04 Mar 2024 08:18:05 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian Unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Wed, 26 Jul 2023 13:26:17 -0500" }, { "cves": [], "log": [ "", " * Temporarily disable orphan_file by default, such that fsck from jammy", " can check ext4 created in mantic. Given the new incompat ext4 features", " that v5.15 & hwe kernels support, ideally e2fsprogs 1.47.0 should be", " SRUed into jammy. LP: #2025339", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu2", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [ 2025339 ], "author": "Dimitri John Ledkov ", "date": "Thu, 29 Jun 2023 10:14:32 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Disable the metadata_csum_seed feature again, as grub does not yet", " support it (Closes: #866603)", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu1", "urgency": "low", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 17 Feb 2023 11:58:55 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes (applied in Debian):", " - 0001-tests-support-older-versions-of-timeout-in-r_corrupt", " - CVE-2022-1304.patch", "" ], "package": "e2fsprogs", "version": "1.46.6~rc1-1ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Tue, 22 Nov 2022 15:15:27 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds read/write vulnerability", " Issue leads to segmentation fault and possibly arbitrary code", " execution via a specially crafted filesystem.", " - debian/patches/CVE-2022-1304.patch: checks that all leaf nodes of", " file system contain at least one extent.", " - CVE-2022-1304", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu2", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Mark Esler ", "date": "Thu, 02 Jun 2022 22:03:15 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 08 Jan 2022 21:02:36 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 01 Jan 2022 22:41:06 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.4-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Wed, 03 Nov 2021 09:32:13 +0100" }, { "cves": [], "log": [ "", " * Restore mke2fs capability to create files adding patch", "", " - mke2fs: fix creating a file system image w/o a pre-existing file", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu3", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Mon, 30 Aug 2021 17:58:29 +0200" }, { "cves": [], "log": [ "", " * Fix failing tests on bigendian system (LP: #1939409)", " using upstream patches queued for 1.46.4:", "", " - e2fsck: fix f_baddotdir failure on big-endian systems", " - libext2fs: fix translation of Posix ACL's on big-endian systems", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1939409 ], "author": "Heinrich Schuchardt ", "date": "Wed, 11 Aug 2021 19:04:33 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian experimental. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Tue, 10 Aug 2021 10:07:26 +0200" }, { "cves": [], "log": [ "", " * Apply upstream fix for unaligned memory access.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 27 May 2021 13:20:34 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 10 May 2021 14:31:18 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to drop the udeb package.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu2", "urgency": "medium", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 22 Feb 2021 10:30:51 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu1", "urgency": "low", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 29 Jan 2021 12:37:12 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.6-1ubuntu1", "urgency": "low", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 01 May 2020 14:47:58 -0700" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes, included upstream:", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", "" ], "package": "e2fsprogs", "version": "1.45.5-2ubuntu1", "urgency": "low", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2020 22:08:18 -0800" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - CVE-2019-5188", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Wed, 22 Jan 2020 12:01:15 -0300" }, { "cves": [ { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write on the heap", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", " - CVE-2019-5094", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu2", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Mon, 30 Sep 2019 14:57:59 -0300" }, { "cves": [], "log": [ "", " * Merge with Debian testing, remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Adam Conrad ", "date": "Sun, 08 Sep 2019 04:12:08 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size.", "" ], "package": "e2fsprogs", "version": "1.45.2-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 24 Jun 2019 11:51:53 +0200" }, { "cves": [], "log": [ "", " * Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size. LP: #1817097", "" ], "package": "e2fsprogs", "version": "1.45.1-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [ 1817097 ], "author": "Dimitri John Ledkov ", "date": "Wed, 15 May 2019 16:15:22 +0200" } ], "notes": null, "is_version_downgrade": true }, { "name": "libfastjson4:riscv64", "from_version": { "source_package_name": "libfastjson", "source_package_version": "1.2304.0-2build1", "version": "1.2304.0-2build1" }, "to_version": { "source_package_name": "libfastjson", "source_package_version": "1.2304.0-3", "version": "1.2304.0-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Update debhelper-compat to 14", " * Drop redundant Priority, Rules-Requires-Root and Section field", " * Bump Standards-Version to 4.7.4", " * Link libfastjson against libm on glibc ≥ 2.42.", " Patch cherry-picked from https://github.com/rsyslog/libfastjson/pull/171", " (Closes: #1114612)", "" ], "package": "libfastjson", "version": "1.2304.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 22 Jul 2026 23:29:57 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfwupd3:riscv64", "from_version": { "source_package_name": "fwupd", "source_package_version": "2.1.1-1ubuntu4", "version": "2.1.1-1ubuntu4" }, "to_version": { "source_package_name": "fwupd", "source_package_version": "2.1.6-3ubuntu1", "version": "2.1.6-3ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148183, 2156480, 2156479, 2156612, 2148673, 2147129, 2146332, 2143688, 2142298, 2139611, 2138609 ], "changes": [ { "cves": [], "log": [ "", " * d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch", " - Fix recovery key prompt for multi-boot systems. Previously an error made", " fwupdmgr prompt all systems where hardware-backed FDE was detected, when", " it should only verify against the current system IFF it is running under", " snapd FDE. (LP: #2148183)", " - Fix incorrect error propagation. If CTRL-D was sent, the process would", " expose an incorrect error propagation in the recovery key verification.", " (LP: #2156480)", " - Link to Ubuntu TPM docs if snapd FDE is detected. Previously bugs", " related to this temporary patch could get reported upstream, leading", " to confusion as this is a short-term solution that will not get merged", " upstream.", " * d/p/mtd-fall-back-to-generic-firmware.patch: Fix an error on MTD devices", " where gtype was incorrectly set to G_TYPE_INVALID (LP: #2156479)", " * d/p/fix-device-locker-crash.patch: Fix an error where the genesys-gl32xx", " plugin would crash due to using the wrong detach and attach callbacks", " (LP: #2156612)", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148183, 2156480, 2156479, 2156612 ], "author": "Simon Johnsson ", "date": "Thu, 18 Jun 2026 16:01:12 +0200" }, { "cves": [], "log": [ "", " * d/p/algoltek-usbcr-Restore-vendor-ID-check-in-probe-func.patch:", " Fix algotek plugin probing hardware it shouldn't. (LP: #2148673)", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148673 ], "author": "Mario Limonciello ", "date": "Fri, 17 Apr 2026 13:44:18 -0500" }, { "cves": [], "log": [ "", " * d/p/fix-notify-snapd-default-image.patch: Fix snapd failed to", " notify bug when only the default image was used. (LP: #2147129)", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147129 ], "author": "Simon Johnsson ", "date": "Tue, 07 Apr 2026 10:14:35 +0200" }, { "cves": [], "log": [ "", " * New upstream version (LP: #2146332)", " * Drop patches merged upstream.", " * Merge with Debian unstable. Remaining changes:", " - d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch: Make fwupdmgr", " verify snapd recovery key through prompt on updates affecting FDE.", "" ], "package": "fwupd", "version": "2.1.1-1ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146332 ], "author": "Mario Limonciello ", "date": "Thu, 26 Mar 2026 12:46:28 -0500" }, { "cves": [], "log": [ "", " * d/patches/dell-uod-behavior.patch: Backport from 2_0_X branch to fix", " UOD behavior for some Dell docks. (LP: #2143688)", "" ], "package": "fwupd", "version": "2.0.20-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143688 ], "author": "Mario Limonciello ", "date": "Mon, 09 Mar 2026 11:48:10 -0500" }, { "cves": [], "log": [ "", " * Enable UMA carveout feature (LP: #2142298)", " * Merge from Debian unstable. Remaining changes:", " - d/p/db-update-snapd-bad-request.patch: On TPM/FDE systems, db updates", " require notifying snapd for preparation. However, the payload uses an", " incorrect format for composite updates. Change the format to align", " with snapd.", " - d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch: Make fwupdmgr", " verify snapd recovery key through prompt on updates affecting FDE.", "" ], "package": "fwupd", "version": "2.0.20-1ubuntu1", "urgency": "low", "distributions": "resolute", "launchpad_bugs_fixed": [ 2142298 ], "author": "Mario Limonciello ", "date": "Fri, 27 Feb 2026 20:24:47 -0600" }, { "cves": [], "log": [ "", " * Fix snapd bad request on db updates (LP: #2139611):", " - d/p/db-update-snapd-bad-request.patch: On TPM/FDE systems, db updates", " require notifying snapd for preparation. However, the payload uses an", " incorrect format for composite updates. Change the format to align", " with snapd.", "" ], "package": "fwupd", "version": "2.0.19-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2139611 ], "author": "Simon Johnsson ", "date": "Mon, 23 Feb 2026 12:12:45 +0100" }, { "cves": [], "log": [ "", " * d/p/fwupdmgr-fde-verify-snapd-recovery-key.patch: Make fwupdmgr", " verify snapd recovery key through prompt on updates affecting FDE.", " (LP: #2138609)", "" ], "package": "fwupd", "version": "2.0.19-1ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138609 ], "author": "Simon Johnsson ", "date": "Thu, 22 Jan 2026 16:38:17 +0100" } ], "notes": null, "is_version_downgrade": true }, { "name": "libgpg-error-l10n", "from_version": { "source_package_name": "libgpg-error", "source_package_version": "1.58-2", "version": "1.58-2" }, "to_version": { "source_package_name": "libgpg-error", "source_package_version": "1.61-3", "version": "1.61-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Add two post-release patches. This includes the fix for the testsuite", " error on armhf.", "" ], "package": "libgpg-error", "version": "1.61-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 25 Jun 2026 18:38:06 +0200" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "libgpg-error", "version": "1.61-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 16 May 2026 16:30:46 +0200" }, { "cves": [], "log": [ "", " * New upstream version.", " + Drop pkgconf b-d.", " * autopkgtest: Depend on pkgconf instead of pkg-config.", "" ], "package": "libgpg-error", "version": "1.61-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 14 May 2026 07:05:54 +0200" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "libgpg-error", "version": "1.59-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 06:53:15 +0100" }, { "cves": [], "log": [ "", " * Workaround wine10 changes in autopkgtest (Closes: #1127142)", "" ], "package": "libgpg-error", "version": "1.59-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Wed, 25 Feb 2026 18:29:44 +0100" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "libgpg-error", "version": "1.59-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 24 Feb 2026 17:39:51 +0100" }, { "cves": [], "log": [ "", " * New upstream version.", " * Bump copyright year.", " * Run wrap-and-sort -ast", "" ], "package": "libgpg-error", "version": "1.59-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 13:09:41 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgpg-error0:riscv64", "from_version": { "source_package_name": "libgpg-error", "source_package_version": "1.58-2", "version": "1.58-2" }, "to_version": { "source_package_name": "libgpg-error", "source_package_version": "1.61-3", "version": "1.61-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Add two post-release patches. This includes the fix for the testsuite", " error on armhf.", "" ], "package": "libgpg-error", "version": "1.61-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 25 Jun 2026 18:38:06 +0200" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "libgpg-error", "version": "1.61-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 16 May 2026 16:30:46 +0200" }, { "cves": [], "log": [ "", " * New upstream version.", " + Drop pkgconf b-d.", " * autopkgtest: Depend on pkgconf instead of pkg-config.", "" ], "package": "libgpg-error", "version": "1.61-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Thu, 14 May 2026 07:05:54 +0200" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "libgpg-error", "version": "1.59-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 28 Feb 2026 06:53:15 +0100" }, { "cves": [], "log": [ "", " * Workaround wine10 changes in autopkgtest (Closes: #1127142)", "" ], "package": "libgpg-error", "version": "1.59-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Wed, 25 Feb 2026 18:29:44 +0100" }, { "cves": [], "log": [ "", " * Upload to unstable.", "" ], "package": "libgpg-error", "version": "1.59-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Tue, 24 Feb 2026 17:39:51 +0100" }, { "cves": [], "log": [ "", " * New upstream version.", " * Bump copyright year.", " * Run wrap-and-sort -ast", "" ], "package": "libgpg-error", "version": "1.59-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 21 Feb 2026 13:09:41 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgpgme45:riscv64", "from_version": { "source_package_name": "gpgme1.0", "source_package_version": "2.1.0-2", "version": "2.1.0-2" }, "to_version": { "source_package_name": "gpgme1.0", "source_package_version": "2.1.2-1", "version": "2.1.2-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version.", " * Upload to unstable.", "" ], "package": "gpgme1.0", "version": "2.1.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 04 Jul 2026 10:11:25 +0200" }, { "cves": [], "log": [ "", " * New upstream version.", "" ], "package": "gpgme1.0", "version": "2.1.1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 27 Jun 2026 10:37:56 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgstreamer1.0-0:riscv64", "from_version": { "source_package_name": "gstreamer1.0", "source_package_version": "1.28.3-1", "version": "1.28.3-1" }, "to_version": { "source_package_name": "gstreamer1.0", "source_package_version": "1.28.4-2", "version": "1.28.4-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * d/patches: disable flaky gst_gstdevice test", "" ], "package": "gstreamer1.0", "version": "1.28.4-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Marc Leeman ", "date": "Mon, 22 Jun 2026 15:52:31 +0200" }, { "cves": [], "log": [ "", " * New upstream version 1.28.4", "" ], "package": "gstreamer1.0", "version": "1.28.4-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Marc Leeman ", "date": "Mon, 15 Jun 2026 08:28:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libldap-common", "from_version": { "source_package_name": "openldap", "source_package_version": "2.6.10+dfsg-1ubuntu6", "version": "2.6.10+dfsg-1ubuntu6" }, "to_version": { "source_package_name": "openldap", "source_package_version": "2.6.13+dfsg-1ubuntu1", "version": "2.6.13+dfsg-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2158806, 2121816, 12470, 2152633 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2158806). Remaining changes:", " - Enable AppArmor support:", " + d/apparmor-profile: add AppArmor profile", " + d/rules: use dh_apparmor", " + d/control: Build-Depends on dh-apparmor", " + d/slapd.README.Debian: add note about AppArmor", " - Enable ufw support:", " + d/control: suggest ufw.", " + d/rules: install ufw profile.", " + d/slapd.ufw.profile: add ufw profile.", " - d/{rules,slapd.py}: Add apport hook.", " - d/t/smbk5pwd: Allow the openldap user to read the Heimdal master", " key in the smbk5pwd DEP8 test (LP #2004560)", " [ Partially incorporated by Debian. ]", " - d/control: make libldap2 depend on libldap-common.", " (LP #2063161)", " - d/rules: remove override_dh_auto_build target", " + dh_auto_build-indep isn't run because of this leftover.", " + it was removed in debian in 2.6.9+dfsg-1", " - d/rules: fix dh_apparmor being skipped in -indep for -arch slapd package (LP #2119884)", " - d/apparmor-profile: add systemd-notify support (LP #2119884)", " - d/t/slapd: test if running in apparmor enforce mode (LP #2119884)", " - pbkdf2 changes:", " + d/p/lp2125685-pbkdf2-configurable-rounds: make iterations configurable (LP #2125685)", " + d/p/lp2125685-pbkdf2-fix-iteration-arg: fix iteration argument index (LP #2125685)", " [ The above upstream but unreleased (openldap) ]", " + d/t/pbkdf2-contrib: test if pbkdf2 hashing rounds are adjustable (LP #2125685)", " * Dropped changes:", " - d/t/ppm-contrib: test ppm password quality module (LP #2121816)", " [ Upstream in 2.6.13+dfsg-1 ]", " - d/slapd.config: fix infinite loop for invalid initial config (LP #12470)", " [ Upstream in 2.6.13+dfsg-1 ]", "" ], "package": "openldap", "version": "2.6.13+dfsg-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158806 ], "author": "Grayson Wolf ", "date": "Mon, 06 Jul 2026 15:09:19 -0400" }, { "cves": [], "log": [ "", " [ Ryan Tandy ]", " * New upstream release.", " - fixed libldap assertion failure on certain invalid server responses", " (ITS#10370) (Closes: #1109791)", " * Temporarily disable slapd-smbk5pwd autopkgtest, broken by heimdal-kdc", " lacking a systemd unit file; see #1039220.", " * Set libldap2-dev to Architecture: any and Multi-Arch: same, matching the", " real libldap-dev package that it depends on. Thanks to Helmut Grohne.", " (Closes: #1103918)", " * d/watch: Use the openldap-release index instead of just the current", " release page. Fixes \"uscan --download-current-version\" when the current", " version is not the latest.", " * Update Portuguese debconf templates translation.", " Thanks to Américo Monteiro. (Closes: #1107415)", " * Add Chinese debconf templates translations.", " Thanks to Yangfl. (Closes: #1124973)", " * Move the slapd-pw-sha2(5) man page to the slapd package.", " Thanks to Jens Meißner. (Closes: #1130869)", " * Update Italian debconf templates translation.", " Thanks to Luca Monducci.", " * Change default shell for openldap user from /bin/false to systemd-sysusers", " default shell (/usr/sbin/nologin).", " * Create the openldap user unconditionally, even if SLAPD_USER is changed.", " If needed, the user name can be customized, or creation disabled, by", " overriding /usr/lib/sysusers.d/slapd.conf with a drop-in.", " * Add upstream patch to fix test017 failing on 32-bit systems. (ITS#10508)", " * Build and install the slapo-autoca(5) overlay. (Closes: #1131044)", " * Install nestgroup.la, missed when slapo-nestgroup(5) was added.", " * Add upstream patch to fix FTBFS with OpenSSL 4.0.", " (ITS#10498) (Closes: #1138420)", " * d/control:", " - Update Standards-Version to 4.7.4.", " - Drop redundant Priority and Rules-Require-Root fields.", "", " [ Jonas Jelten ]", " * d/t/ppm-contrib: test ppm password quality module (LP: #2121816)", " * d/slapd.config: fix infinite loop for invalid initial config (LP: #12470)", "", " [ Luca Boccassi ]", " * Use dh-sequence-installsysusers for system user/group creation", " (Closes: #1104574)", "", " [ Grayson Wolf ]", " * d/slapd.service: make ExecStart path absolute (LP: #2152633)", "" ], "package": "openldap", "version": "2.6.13+dfsg-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2121816, 12470, 2152633 ], "author": "Ryan Tandy ", "date": "Mon, 22 Jun 2026 15:45:06 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "libldap2:riscv64", "from_version": { "source_package_name": "openldap", "source_package_version": "2.6.10+dfsg-1ubuntu6", "version": "2.6.10+dfsg-1ubuntu6" }, "to_version": { "source_package_name": "openldap", "source_package_version": "2.6.13+dfsg-1ubuntu1", "version": "2.6.13+dfsg-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2158806, 2121816, 12470, 2152633 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2158806). Remaining changes:", " - Enable AppArmor support:", " + d/apparmor-profile: add AppArmor profile", " + d/rules: use dh_apparmor", " + d/control: Build-Depends on dh-apparmor", " + d/slapd.README.Debian: add note about AppArmor", " - Enable ufw support:", " + d/control: suggest ufw.", " + d/rules: install ufw profile.", " + d/slapd.ufw.profile: add ufw profile.", " - d/{rules,slapd.py}: Add apport hook.", " - d/t/smbk5pwd: Allow the openldap user to read the Heimdal master", " key in the smbk5pwd DEP8 test (LP #2004560)", " [ Partially incorporated by Debian. ]", " - d/control: make libldap2 depend on libldap-common.", " (LP #2063161)", " - d/rules: remove override_dh_auto_build target", " + dh_auto_build-indep isn't run because of this leftover.", " + it was removed in debian in 2.6.9+dfsg-1", " - d/rules: fix dh_apparmor being skipped in -indep for -arch slapd package (LP #2119884)", " - d/apparmor-profile: add systemd-notify support (LP #2119884)", " - d/t/slapd: test if running in apparmor enforce mode (LP #2119884)", " - pbkdf2 changes:", " + d/p/lp2125685-pbkdf2-configurable-rounds: make iterations configurable (LP #2125685)", " + d/p/lp2125685-pbkdf2-fix-iteration-arg: fix iteration argument index (LP #2125685)", " [ The above upstream but unreleased (openldap) ]", " + d/t/pbkdf2-contrib: test if pbkdf2 hashing rounds are adjustable (LP #2125685)", " * Dropped changes:", " - d/t/ppm-contrib: test ppm password quality module (LP #2121816)", " [ Upstream in 2.6.13+dfsg-1 ]", " - d/slapd.config: fix infinite loop for invalid initial config (LP #12470)", " [ Upstream in 2.6.13+dfsg-1 ]", "" ], "package": "openldap", "version": "2.6.13+dfsg-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158806 ], "author": "Grayson Wolf ", "date": "Mon, 06 Jul 2026 15:09:19 -0400" }, { "cves": [], "log": [ "", " [ Ryan Tandy ]", " * New upstream release.", " - fixed libldap assertion failure on certain invalid server responses", " (ITS#10370) (Closes: #1109791)", " * Temporarily disable slapd-smbk5pwd autopkgtest, broken by heimdal-kdc", " lacking a systemd unit file; see #1039220.", " * Set libldap2-dev to Architecture: any and Multi-Arch: same, matching the", " real libldap-dev package that it depends on. Thanks to Helmut Grohne.", " (Closes: #1103918)", " * d/watch: Use the openldap-release index instead of just the current", " release page. Fixes \"uscan --download-current-version\" when the current", " version is not the latest.", " * Update Portuguese debconf templates translation.", " Thanks to Américo Monteiro. (Closes: #1107415)", " * Add Chinese debconf templates translations.", " Thanks to Yangfl. (Closes: #1124973)", " * Move the slapd-pw-sha2(5) man page to the slapd package.", " Thanks to Jens Meißner. (Closes: #1130869)", " * Update Italian debconf templates translation.", " Thanks to Luca Monducci.", " * Change default shell for openldap user from /bin/false to systemd-sysusers", " default shell (/usr/sbin/nologin).", " * Create the openldap user unconditionally, even if SLAPD_USER is changed.", " If needed, the user name can be customized, or creation disabled, by", " overriding /usr/lib/sysusers.d/slapd.conf with a drop-in.", " * Add upstream patch to fix test017 failing on 32-bit systems. (ITS#10508)", " * Build and install the slapo-autoca(5) overlay. (Closes: #1131044)", " * Install nestgroup.la, missed when slapo-nestgroup(5) was added.", " * Add upstream patch to fix FTBFS with OpenSSL 4.0.", " (ITS#10498) (Closes: #1138420)", " * d/control:", " - Update Standards-Version to 4.7.4.", " - Drop redundant Priority and Rules-Require-Root fields.", "", " [ Jonas Jelten ]", " * d/t/ppm-contrib: test ppm password quality module (LP: #2121816)", " * d/slapd.config: fix infinite loop for invalid initial config (LP: #12470)", "", " [ Luca Boccassi ]", " * Use dh-sequence-installsysusers for system user/group creation", " (Closes: #1104574)", "", " [ Grayson Wolf ]", " * d/slapd.service: make ExecStart path absolute (LP: #2152633)", "" ], "package": "openldap", "version": "2.6.13+dfsg-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2121816, 12470, 2152633 ], "author": "Ryan Tandy ", "date": "Mon, 22 Jun 2026 15:45:06 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblocale-gettext-perl", "from_version": { "source_package_name": "liblocale-gettext-perl", "source_package_version": "1.07-8", "version": "1.07-8" }, "to_version": { "source_package_name": "liblocale-gettext-perl", "source_package_version": "1.07-10", "version": "1.07-10" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Set LANGUAGE as well for tests during build and autopkgtests.", " Thanks to Helmut Grohne for the bug report.", " (Closes: #1136442)", "" ], "package": "liblocale-gettext-perl", "version": "1.07-10", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "gregor herrmann ", "date": "Thu, 14 May 2026 17:28:55 +0200" }, { "cves": [], "log": [ "", " * Drop Priority field.", " Thanks to Gioele Barabucci for the bug report.", " (Closes: #1134756)", " * Declare compliance with Debian Policy 4.7.4.", "" ], "package": "liblocale-gettext-perl", "version": "1.07-9", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "gregor herrmann ", "date": "Tue, 05 May 2026 11:46:18 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnewt0.52:riscv64", "from_version": { "source_package_name": "newt", "source_package_version": "0.52.25-1ubuntu3", "version": "0.52.25-1ubuntu3" }, "to_version": { "source_package_name": "newt", "source_package_version": "0.52.25-2ubuntu1", "version": "0.52.25-2ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2153340 ], "changes": [ { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #2153340), remaining changes:", " + Remove libnewt0.52.preinst altogether, which contains destructive", " operations with none of the appropriate version guards", " + Add correct build-dependencies on python3-all-dbg and", " libpython3-all-dbg, needed due to debian/patches/snack.patch", " + Don't install python-newt example files", " + Install/remove alternatives for the ubuntu palette", " + Revert Debian's dropping of /etc/newt/palette.original, used as an", " alternative in Ubuntu", "" ], "package": "newt", "version": "0.52.25-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153340 ], "author": "Graham Inggs ", "date": "Tue, 14 Jul 2026 15:34:38 +0000" }, { "cves": [], "log": [ "", " * Update VCS after repo move", " * Drop priority: optional", " * Standards-Version: 4.7.3", " * Drop leading / in install files debian/*.install", " * Change http: to https: in debian/patches/*", " * d/control: remove obsolete versioning dependencies", " * Updated Kazakh patch. Closes: #1126118", "" ], "package": "newt", "version": "0.52.25-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alastair McKinstry ", "date": "Fri, 13 Feb 2026 06:34:38 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnghttp2-14:riscv64", "from_version": { "source_package_name": "nghttp2", "source_package_version": "1.68.0-2", "version": "1.68.0-2" }, "to_version": { "source_package_name": "nghttp2", "source_package_version": "1.69.0-1", "version": "1.69.0-1" }, "cves": [ { "cve": "CVE-2026-27135", "url": "https://ubuntu.com/security/CVE-2026-27135", "cve_description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.", "cve_priority": "medium", "cve_public_date": "2026-03-18 18:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New release", "" ], "package": "nghttp2", "version": "1.69.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Tomasz Buchert ", "date": "Wed, 22 Apr 2026 18:48:44 +0200" }, { "cves": [ { "cve": "CVE-2026-27135", "url": "https://ubuntu.com/security/CVE-2026-27135", "cve_description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.", "cve_priority": "medium", "cve_public_date": "2026-03-18 18:16:00 UTC" } ], "log": [ "", " * Addresses #1131369 for unstable (CVE-2026-27135)", "" ], "package": "nghttp2", "version": "1.68.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Tomasz Buchert ", "date": "Sun, 29 Mar 2026 12:59:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnspr4:riscv64", "from_version": { "source_package_name": "nspr", "source_package_version": "2:4.38.2-1ubuntu1", "version": "2:4.38.2-1ubuntu1" }, "to_version": { "source_package_name": "nspr", "source_package_version": "2:4.39-1ubuntu1", "version": "2:4.39-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Drop explicit -Wl,--as-needed linker flag. It's the default.", " - Drop explicit CFLAGS that are checked by configure.", " - Also use non-hardening flags from dpkg-buildflags to pick up flags", " like -fno-omit-frame-pointer.", "" ], "package": "nspr", "version": "2:4.39-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Benjamin Drung ", "date": "Thu, 23 Jul 2026 11:25:28 +0200" }, { "cves": [], "log": [ "", " * New upstream release.", "" ], "package": "nspr", "version": "2:4.39-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mike Hommey ", "date": "Wed, 22 Jul 2026 07:23:53 +0900" } ], "notes": null, "is_version_downgrade": false }, { "name": "libp11-kit0:riscv64", "from_version": { "source_package_name": "p11-kit", "source_package_version": "0.26.2-3", "version": "0.26.2-3" }, "to_version": { "source_package_name": "p11-kit", "source_package_version": "0.26.4-1", "version": "0.26.4-1" }, "cves": [ { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "log": [ "", " * New upstream version.", " + server: fixed stack exhaustion via unbounded recursion in RPC attribute", " parsing by enforcing a recursion depth limit (CVE-2026-13757)", " Closes: #1141184", " + Drop 40-Fix-autoreconf-error-with-gettext-1.0.patch", " * Use debhelper-compat v14.", "" ], "package": "p11-kit", "version": "0.26.4-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Andreas Metzler ", "date": "Sat, 11 Jul 2026 15:01:13 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpackagekit-glib2-18:riscv64", "from_version": { "source_package_name": "packagekit", "source_package_version": "1.3.6-1", "version": "1.3.6-1" }, "to_version": { "source_package_name": "packagekit", "source_package_version": "1.3.6-1ubuntu1", "version": "1.3.6-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148469 ], "changes": [ { "cves": [], "log": [ "", " [ Hector Cao ]", " * d/p/lp2148469-apt-use-solve-3.0.patch: use apt solver 3.0", " (LP: #2148469)", "", " [ Alessandro Astone ]", " * d/p/pkgcli-Skip-blocked-updates-in-full-upgrade-too.patch.", " Fix `pkgcli upgrade` command after switching to apt solver 3.0, which would", " fail if some update was held back.", "" ], "package": "packagekit", "version": "1.3.6-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148469 ], "author": "Alessandro Astone ", "date": "Mon, 20 Jul 2026 13:08:28 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libperl5.40:riscv64", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8", "version": "5.40.1-8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8ubuntu1", "version": "5.40.1-8ubuntu1" }, "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: directory traversal vulnerability", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " linkname in Archive::Tar secure extract mode to prevent extraction", " outside the target directory", " - CVE-2026-42496", "" ], "package": "perl", "version": "5.40.1-8ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Thu, 02 Jul 2026 13:14:46 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpsl5t64:riscv64", "from_version": { "source_package_name": "libpsl", "source_package_version": "0.21.5-1", "version": "0.21.5-1" }, "to_version": { "source_package_name": "libpsl", "source_package_version": "0.22.0-1", "version": "0.22.0-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version 0.22.0", " * d/patches/0002-make-psl-make-dafsa-py3-based.patch: refresh", " * d/control: libpsl-dev requires additional dependencies", " * d/: switch build system to meson", " * d/control: Standards-Version: 4.7.4 (no further changes required)", "" ], "package": "libpsl", "version": "0.22.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Florian Ernst ", "date": "Thu, 25 Jun 2026 20:58:56 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsemanage-common", "from_version": { "source_package_name": "libsemanage", "source_package_version": "3.9-1build1", "version": "3.9-1build1" }, "to_version": { "source_package_name": "libsemanage", "source_package_version": "3.10-1", "version": "3.10-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * No-change rebuild to drop Python 3.13 bits.", "" ], "package": "libsemanage", "version": "3.9-1build1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 20 Mar 2026 11:32:37 +0100" } ], "notes": null, "is_version_downgrade": true }, { "name": "libsemanage2:riscv64", "from_version": { "source_package_name": "libsemanage", "source_package_version": "3.9-1build1", "version": "3.9-1build1" }, "to_version": { "source_package_name": "libsemanage", "source_package_version": "3.10-1", "version": "3.10-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * No-change rebuild to drop Python 3.13 bits.", "" ], "package": "libsemanage", "version": "3.9-1build1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 20 Mar 2026 11:32:37 +0100" } ], "notes": null, "is_version_downgrade": true }, { "name": "libsepol2:riscv64", "from_version": { "source_package_name": "libsepol", "source_package_version": "3.10-1", "version": "3.10-1" }, "to_version": { "source_package_name": "libsepol", "source_package_version": "3.11-1", "version": "3.11-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version 3.11", "", " * d/u/signing-key.asc: import new key of Peter Lautrbach", " * d/patches: drop upstream applied patch", " * d/control:", " - bump Standards-Version to 4.7.4 (no further changes)", " - drop unnecessary build-dep on file", " - update homepage", " - drop breaks prior oldstable/bookworm", " - bump debhelper compat level to 14", " * d/rules: describe why tests are disabled", " * d/libsepol2.symbols: add new symbols", "" ], "package": "libsepol", "version": "3.11-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Christian Göttsche ", "date": "Sat, 04 Jul 2026 00:43:20 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libss2:riscv64", "from_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.2-3ubuntu4", "version": "1.47.2-3ubuntu4" }, "to_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.4-1", "version": "1.47.4-1" }, "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "launchpad_bugs_fixed": [ 2138219, 2132257, 2025339, 1939409, 1817097 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix pkgconfig call that results in inability", " to find udev rules.d in dh_install. Patch supplied by", " Helmut Grohne in Debian bug 1126636. (LP: #2138219)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu4", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138219 ], "author": "John Chittum ", "date": "Fri, 13 Feb 2026 07:17:00 -0500" }, { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Mon, 02 Feb 2026 21:34:31 +0100" }, { "cves": [], "log": [ "", " * Rebuild to include updated RISC-V base ISA RVA23", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Wed, 03 Sep 2025 17:46:20 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu1", "urgency": "low", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Thu, 12 Jun 2025 15:13:43 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-1ubuntu1", "urgency": "low", "distributions": "plucky", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 07 Jan 2025 21:26:01 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.1-1ubuntu1", "urgency": "low", "distributions": "oracular", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 25 Jun 2024 11:33:08 +0200" }, { "cves": [], "log": [ "", " * No change rebuild against libfuse2t64.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu4", "urgency": "high", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 08 Apr 2024 16:38:40 +0200" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 07:33:00 +0000" }, { "cves": [], "log": [ "", " * Make the provides for the renamed packages versioned.", " * Break against the first version not building the t64 packages anymore.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Tue, 12 Mar 2024 21:22:45 +0100" }, { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Tue, 12 Mar 2024 11:31:16 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.3ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 04 Mar 2024 08:18:05 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian Unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Wed, 26 Jul 2023 13:26:17 -0500" }, { "cves": [], "log": [ "", " * Temporarily disable orphan_file by default, such that fsck from jammy", " can check ext4 created in mantic. Given the new incompat ext4 features", " that v5.15 & hwe kernels support, ideally e2fsprogs 1.47.0 should be", " SRUed into jammy. LP: #2025339", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu2", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [ 2025339 ], "author": "Dimitri John Ledkov ", "date": "Thu, 29 Jun 2023 10:14:32 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Disable the metadata_csum_seed feature again, as grub does not yet", " support it (Closes: #866603)", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu1", "urgency": "low", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 17 Feb 2023 11:58:55 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes (applied in Debian):", " - 0001-tests-support-older-versions-of-timeout-in-r_corrupt", " - CVE-2022-1304.patch", "" ], "package": "e2fsprogs", "version": "1.46.6~rc1-1ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Tue, 22 Nov 2022 15:15:27 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds read/write vulnerability", " Issue leads to segmentation fault and possibly arbitrary code", " execution via a specially crafted filesystem.", " - debian/patches/CVE-2022-1304.patch: checks that all leaf nodes of", " file system contain at least one extent.", " - CVE-2022-1304", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu2", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Mark Esler ", "date": "Thu, 02 Jun 2022 22:03:15 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 08 Jan 2022 21:02:36 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 01 Jan 2022 22:41:06 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.4-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Wed, 03 Nov 2021 09:32:13 +0100" }, { "cves": [], "log": [ "", " * Restore mke2fs capability to create files adding patch", "", " - mke2fs: fix creating a file system image w/o a pre-existing file", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu3", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Mon, 30 Aug 2021 17:58:29 +0200" }, { "cves": [], "log": [ "", " * Fix failing tests on bigendian system (LP: #1939409)", " using upstream patches queued for 1.46.4:", "", " - e2fsck: fix f_baddotdir failure on big-endian systems", " - libext2fs: fix translation of Posix ACL's on big-endian systems", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1939409 ], "author": "Heinrich Schuchardt ", "date": "Wed, 11 Aug 2021 19:04:33 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian experimental. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Tue, 10 Aug 2021 10:07:26 +0200" }, { "cves": [], "log": [ "", " * Apply upstream fix for unaligned memory access.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 27 May 2021 13:20:34 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 10 May 2021 14:31:18 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to drop the udeb package.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu2", "urgency": "medium", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 22 Feb 2021 10:30:51 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu1", "urgency": "low", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 29 Jan 2021 12:37:12 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.6-1ubuntu1", "urgency": "low", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 01 May 2020 14:47:58 -0700" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes, included upstream:", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", "" ], "package": "e2fsprogs", "version": "1.45.5-2ubuntu1", "urgency": "low", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2020 22:08:18 -0800" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - CVE-2019-5188", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Wed, 22 Jan 2020 12:01:15 -0300" }, { "cves": [ { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write on the heap", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", " - CVE-2019-5094", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu2", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Mon, 30 Sep 2019 14:57:59 -0300" }, { "cves": [], "log": [ "", " * Merge with Debian testing, remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Adam Conrad ", "date": "Sun, 08 Sep 2019 04:12:08 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size.", "" ], "package": "e2fsprogs", "version": "1.45.2-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 24 Jun 2019 11:51:53 +0200" }, { "cves": [], "log": [ "", " * Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size. LP: #1817097", "" ], "package": "e2fsprogs", "version": "1.45.1-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [ 1817097 ], "author": "Dimitri John Ledkov ", "date": "Wed, 15 May 2019 16:15:22 +0200" } ], "notes": null, "is_version_downgrade": true }, { "name": "libssh2-1t64:riscv64", "from_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-3", "version": "1.11.1-3" }, "to_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-4ubuntu1", "version": "1.11.1-4ubuntu1" }, "cves": [ { "cve": "CVE-2026-5805", "url": "https://ubuntu.com/security/CVE-2026-5805", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-58051", "url": "https://ubuntu.com/security/CVE-2026-58051", "cve_description": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" }, { "cve": "CVE-2026-58050", "url": "https://ubuntu.com/security/CVE-2026-58050", "cve_description": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" }, { "cve": "CVE-2025-15661", "url": "https://ubuntu.com/security/CVE-2025-15661", "cve_description": "libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.", "cve_priority": "medium", "cve_public_date": "2026-06-18 21:16:00 UTC" }, { "cve": "CVE-2026-55199", "url": "https://ubuntu.com/security/CVE-2026-55199", "cve_description": "libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.", "cve_priority": "medium", "cve_public_date": "2026-06-17 20:17:00 UTC" }, { "cve": "CVE-2026-55200", "url": "https://ubuntu.com/security/CVE-2026-55200", "cve_description": "libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.", "cve_priority": "medium", "cve_public_date": "2026-06-17 20:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-5805", "url": "https://ubuntu.com/security/CVE-2026-5805", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-58051", "url": "https://ubuntu.com/security/CVE-2026-58051", "cve_description": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" }, { "cve": "CVE-2026-58050", "url": "https://ubuntu.com/security/CVE-2026-58050", "cve_description": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Multiple security issues in publickey", " - debian/patches/CVE-2026-5805x-pre1.patch: fix potential arbitrary free", " in libssh2_publickey_list_fetch().", " - debian/patches/CVE-2026-5805x-pre2.patch: fix potential multiplication", " overflow in 32-bit libssh2_publickey_list_fetch().", " - debian/patches/CVE-2026-5805x-pre3.patch: cap packet size in", " publickey_packet_receive().", " - debian/patches/CVE-2026-5805x-pre4.patch: fix leaks when", " publickey_response_success() received <8 bytes.", " - debian/patches/CVE-2026-5805x-pre5.patch: fix potential OOB read in", " publickey_response_success().", " - debian/patches/CVE-2026-58051.patch: fix potential OOB read in", " libssh2_publickey_list_fetch().", " - debian/patches/CVE-2026-5805x-pre6.patch: fix potential OOB read.", " - debian/patches/CVE-2026-5805x-pre7.patch: flatten bounds check if blocks", " (tidy-up).", " - debian/patches/CVE-2026-5805x-pre8.patch: rework bounds checks to avoid", " pointer comparisons.", " - debian/patches/CVE-2026-58050.patch: cap variable-length packet element", " sizes.", " - CVE-2026-58050", " - CVE-2026-58051", "" ], "package": "libssh2", "version": "1.11.1-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 07 Jul 2026 14:23:05 -0400" }, { "cves": [ { "cve": "CVE-2025-15661", "url": "https://ubuntu.com/security/CVE-2025-15661", "cve_description": "libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.", "cve_priority": "medium", "cve_public_date": "2026-06-18 21:16:00 UTC" }, { "cve": "CVE-2026-55199", "url": "https://ubuntu.com/security/CVE-2026-55199", "cve_description": "libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.", "cve_priority": "medium", "cve_public_date": "2026-06-17 20:17:00 UTC" }, { "cve": "CVE-2026-55200", "url": "https://ubuntu.com/security/CVE-2026-55200", "cve_description": "libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.", "cve_priority": "medium", "cve_public_date": "2026-06-17 20:17:00 UTC" } ], "log": [ "", " [ Moritz Mühlenhoff ]", " * d/patches: Fix CVEs CVE-2025-15661 CVE-2026-55199 CVE-2026-55200", " (Closes: #1140401)", "" ], "package": "libssh2", "version": "1.11.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Nicolas Mora ", "date": "Wed, 24 Jun 2026 09:10:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssl3t64:riscv64", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3", "version": "3.5.5-1ubuntu3" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu4", "version": "3.5.5-1ubuntu4" }, "cves": [ { "cve": "CVE-2026-34180", "url": "https://ubuntu.com/security/CVE-2026-34180", "cve_description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34181", "url": "https://ubuntu.com/security/CVE-2026-34181", "cve_description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34182", "url": "https://ubuntu.com/security/CVE-2026-34182", "cve_description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34183", "url": "https://ubuntu.com/security/CVE-2026-34183", "cve_description": "Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42764", "url": "https://ubuntu.com/security/CVE-2026-42764", "cve_description": "Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42766", "url": "https://ubuntu.com/security/CVE-2026-42766", "cve_description": "Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42767", "url": "https://ubuntu.com/security/CVE-2026-42767", "cve_description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42768", "url": "https://ubuntu.com/security/CVE-2026-42768", "cve_description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42769", "url": "https://ubuntu.com/security/CVE-2026-42769", "cve_description": "Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42770", "url": "https://ubuntu.com/security/CVE-2026-42770", "cve_description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45445", "url": "https://ubuntu.com/security/CVE-2026-45445", "cve_description": "Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45446", "url": "https://ubuntu.com/security/CVE-2026-45446", "cve_description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45447", "url": "https://ubuntu.com/security/CVE-2026-45447", "cve_description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-7383", "url": "https://ubuntu.com/security/CVE-2026-7383", "cve_description": "Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-9076", "url": "https://ubuntu.com/security/CVE-2026-9076", "cve_description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-34180", "url": "https://ubuntu.com/security/CVE-2026-34180", "cve_description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34181", "url": "https://ubuntu.com/security/CVE-2026-34181", "cve_description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34182", "url": "https://ubuntu.com/security/CVE-2026-34182", "cve_description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34183", "url": "https://ubuntu.com/security/CVE-2026-34183", "cve_description": "Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42764", "url": "https://ubuntu.com/security/CVE-2026-42764", "cve_description": "Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42766", "url": "https://ubuntu.com/security/CVE-2026-42766", "cve_description": "Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42767", "url": "https://ubuntu.com/security/CVE-2026-42767", "cve_description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42768", "url": "https://ubuntu.com/security/CVE-2026-42768", "cve_description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42769", "url": "https://ubuntu.com/security/CVE-2026-42769", "cve_description": "Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42770", "url": "https://ubuntu.com/security/CVE-2026-42770", "cve_description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45445", "url": "https://ubuntu.com/security/CVE-2026-45445", "cve_description": "Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45446", "url": "https://ubuntu.com/security/CVE-2026-45446", "cve_description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45447", "url": "https://ubuntu.com/security/CVE-2026-45447", "cve_description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-7383", "url": "https://ubuntu.com/security/CVE-2026-7383", "cve_description": "Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-9076", "url": "https://ubuntu.com/security/CVE-2026-9076", "cve_description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Heap Buffer Over-read in ASN.1 Content Parsing", " - debian/patches/CVE-2026-34180.patch: Avoid length truncation in", " ASN1_STRING_set in crypto/asn1/tasn_dec.c.", " - CVE-2026-34180", " * SECURITY UPDATE: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys", " - debian/patches/CVE-2026-34181.patch: pkcs12: verify that the pbmac1 key", " length is safe in crypto/pkcs12/p12_mutl.c.", " - CVE-2026-34181", " * SECURITY UPDATE: CMS AuthEnvelopedData Processing May Accept Forged Messages", " - debian/patches/CVE-2026-34182-1.patch: Reject potentially forged encrypted", " CMS AuthEnvelopedData messages in crypto/cms/cms_enc.c.", " - debian/patches/CVE-2026-34182-2.patch: Add tests for CVE-2026-34182 in", " test/cmsapitest.c.", " - CVE-2026-34182", " * SECURITY UPDATE: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", " - debian/patches/CVE-2026-34183-1.patch: QUIC stack must limit the number of", " PATH_CHALLENGE frames processed in RX in include/internal/quic_cfq.h,", " include/internal/quic_channel.h, include/internal/quic_fifd.h,", " ssl/quic/quic_cfq.c, ssl/quic/quic_channel.c,", " ssl/quic/quic_channel_local.h, ssl/quic/quic_fifd.c,", " ssl/quic/quic_rx_depack.c, ssl/quic/quic_txp.c.", " - debian/patches/CVE-2026-34183-2.patch: Add test for path challenge flood", " mitigation in include/internal/quic_channel.h, ssl/quic/quic_channel.c,", " ssl/quic/quic_channel_local.h, ssl/quic/quic_rx_depack.c,", " test/radix/quic_tests.c.", " - CVE-2026-34183", " * SECURITY UPDATE: NULL pointer dereference in QUIC server initial packet", " handling", " - debian/patches/CVE-2026-42764.patch: Fix NULL dereference in QUIC address", " validation in ssl/quic/quic_port.c.", " - CVE-2026-42764", " * SECURITY UPDATE: Possible NULL Dereference in Password-Based CMS Decryption", " - debian/patches/CVE-2026-42766.patch: Fix potential NULL dereference", " processing CMS PasswordRecipientInfo in crypto/cms/cms_pwri.c.", " - CVE-2026-42766", " * SECURITY UPDATE: NULL Pointer Dereference in CRMF EncryptedValue Decryption", " - debian/patches/CVE-2026-42767.patch: Fix potential NULL dereference in", " OSSL_CRMF_ENCRYPTEDVALUE_decrypt() in crypto/crmf/crmf_lib.c.", " - CVE-2026-42767", " * SECURITY UPDATE: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()", " and PKCS7_decrypt()", " - debian/patches/CVE-2026-42768.patch: Enforce implicit rejection for", " CMS/PKCS#7 decryption in crypto/cms/cms_env.c, crypto/pkcs7/pk7_doit.c,", " doc/man3/CMS_decrypt.pod, doc/man3/PKCS7_decrypt.pod.", " - CVE-2026-42768", " * SECURITY UPDATE: Trust-Anchor Substitution via cert/issuer Typo in CMP", " rootCaKeyUpdate", " - debian/patches/CVE-2026-42769.patch: Use the correct issuer when", " validating rootCAKeyUpdate in crypto/cmp/cmp_genm.c.", " - CVE-2026-42769", " * SECURITY UPDATE: FFC-DH Peer Validation Uses Attacker-Supplied q", " - debian/patches/CVE-2026-42770.patch: Match the local q DHX parameter", " against the peer's q in providers/implementations/exchange/dh_exch.c.", " - CVE-2026-42770", " * SECURITY UPDATE: AES-OCB IV Ignored on EVP_Cipher() Path", " - debian/patches/CVE-2026-45445.patch: Apply the buffered IV on the AES-OCB", " EVP_Cipher() path in providers/implementations/ciphers/cipher_aes_ocb.c,", " test/evp_extra_test.c.", " - CVE-2026-45445", " * SECURITY UPDATE: Incorrect Tag Processing for Empty Messages in", " AES-GCM-SIV and AES-SIV modes", " - debian/patches/CVE-2026-45446.patch: Fix handling of empty-ciphertext", " messages in AES-GCM-SIV and AES-SIV in", " providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,", " providers/implementations/ciphers/cipher_aes_siv.c, test/evp_extra_test.c.", " - CVE-2026-45446", " * SECURITY UPDATE: Heap Use-After-Free in OpenSSL PKCS7_verify()", " - debian/patches/CVE-2026-45447-1.patch: Fix possible use-after-free in", " OpenSSL PKCS7_verify() in crypto/pkcs7/pk7_smime.c.", " - debian/patches/CVE-2026-45447-2.patch: Test for CVE-2026-45447 (UAF in", " PKCS7_verify) in test/recipes/80-test_cms.t, test/smime-eml/pkcs7-empty-", " digest-set.eml.", " - CVE-2026-45447", " * SECURITY UPDATE: Possible Heap Buffer Overflow in ASN.1 Multibyte String", " Conversion", " - debian/patches/CVE-2026-7383.patch: Reject oversized inputs in", " ASN1_mbstring_ncopy() in crypto/asn1/a_mbstr.c.", " - CVE-2026-7383", " * SECURITY UPDATE: Out-of-Bounds Read in CMS Password-Based Decryption", " - debian/patches/CVE-2026-9076.patch: cms: kek_unwrap_key: Fix out-of-", " bounds read in check-byte validation in crypto/cms/cms_pwri.c.", " - CVE-2026-9076", " * Fix ppc64 FTBFS because of incorrect regex match (LP: 2137464)", " - debian/patches/regex_match_ecp_nistp521-ppc64.patch: removed,", " incomplete version.", " - debian/patches/fix_ppc64_regex_match.patch: match last filename for", " output in ecp_nistp*-ppc64.pl.", "" ], "package": "openssl", "version": "3.5.5-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 02 Jun 2026 13:21:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudisks2-0:riscv64", "from_version": { "source_package_name": "udisks2", "source_package_version": "2.10.91-1ubuntu2", "version": "2.10.91-1ubuntu2" }, "to_version": { "source_package_name": "udisks2", "source_package_version": "2.11.1-2ubuntu1", "version": "2.11.1-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2153367 ], "changes": [ { "cves": [ { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" } ], "log": [ "", " * Merge from Debian unstable (LP: #2153367), remaining changes:", " * d/p/nvme-disk-size.patch:", " - use upstream candidate fix for getting the size of nvme drives", " * Dropped patches CVE-2026-26103 and CVE-2026-26104 included upstream", "" ], "package": "udisks2", "version": "2.11.1-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153367 ], "author": "Graham Inggs ", "date": "Sun, 12 Jul 2026 12:24:44 +0000" }, { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Bump Standards-Version to 4.7.4", " * Revert \"Skip MDRaid test as it depends on targetcli-fb\"", " * Fix integration test test_exfat with exfatprogs >= 1.4.0 (Closes: #1141111)", "" ], "package": "udisks2", "version": "2.11.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:10:23 +0200" }, { "cves": [ { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" } ], "log": [ "", " * New upstream version 2.11.1", " - Add missing polkit checks for RestoreEncryptedHeader() and", " HeaderBackup(). (CVE-2026-26103, CVE-2026-26104)", "" ], "package": "udisks2", "version": "2.11.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Thu, 26 Feb 2026 16:32:10 +0100" }, { "cves": [], "log": [ "", " [ Jeremy Bícha ]", " * Remove unnecessary Suggests: devhelp", "", " [ Michael Biebl ]", " * Remove redundant Priority and Rules-Requires-Root field", " * Bump Standards-Version to 4.7.3", " * Drop reisefsprogs from Suggests and autopkgtest Depends.", " ReiserFS support has been removed in Linux 6.13 and the reiserfsprogs", " package was removed from the archive accordingly.", " * Skip MDRaid test as it depends on targetcli-fb.", " The targetcli-fb package and its dependencies are currently not", " available in testing. See #1124263.", "" ], "package": "udisks2", "version": "2.11.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Thu, 12 Feb 2026 17:49:24 +0100" }, { "cves": [], "log": [ "", " * New upstream version 2.11.0", " * Bump minimum required version of libblockdev to >= 3.4", " * Drop patches, merged upstream", " * Update symbols file for libudisks2-0", "" ], "package": "udisks2", "version": "2.11.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Tue, 18 Nov 2025 21:43:32 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.2", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:46:22 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Tue, 23 Jun 2026 14:55:07 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-4.4.0", "" ], "package": "linux-meta-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 17 Jun 2026 11:27:41 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-26.26.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-26.26.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 03 Jun 2026 12:02:33 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-22.22.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-22.22.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Tue, 26 May 2026 17:25:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.2", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:46:22 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Tue, 23 Jun 2026 14:55:07 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-4.4.0", "" ], "package": "linux-meta-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 17 Jun 2026 11:27:41 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-26.26.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-26.26.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 03 Jun 2026 12:02:33 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-22.22.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-22.22.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Tue, 26 May 2026 17:25:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.2", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:46:22 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Tue, 23 Jun 2026 14:55:07 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-4.4.0", "" ], "package": "linux-meta-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 17 Jun 2026 11:27:41 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-26.26.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-26.26.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 03 Jun 2026 12:02:33 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-22.22.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-22.22.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Tue, 26 May 2026 17:25:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": "linux-meta-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.2", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:46:22 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-5.5.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Tue, 23 Jun 2026 14:55:07 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.1.0-4.4.0", "" ], "package": "linux-meta-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 17 Jun 2026 11:27:41 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-26.26.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-26.26.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 03 Jun 2026 12:02:33 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-22.22.1", "" ], "package": "linux-meta-riscv", "version": "7.0.0-22.22.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Edoardo Canepa ", "date": "Tue, 26 May 2026 17:25:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "logsave", "from_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.2-3ubuntu4", "version": "1.47.2-3ubuntu4" }, "to_version": { "source_package_name": "e2fsprogs", "source_package_version": "1.47.4-1", "version": "1.47.4-1" }, "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" }, { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "launchpad_bugs_fixed": [ 2138219, 2132257, 2025339, 1939409, 1817097 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: fix pkgconfig call that results in inability", " to find udev rules.d in dh_install. Patch supplied by", " Helmut Grohne in Debian bug 1126636. (LP: #2138219)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu4", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138219 ], "author": "John Chittum ", "date": "Fri, 13 Feb 2026 07:17:00 -0500" }, { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Mon, 02 Feb 2026 21:34:31 +0100" }, { "cves": [], "log": [ "", " * Rebuild to include updated RISC-V base ISA RVA23", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Wed, 03 Sep 2025 17:46:20 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-3ubuntu1", "urgency": "low", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Thu, 12 Jun 2025 15:13:43 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.2-1ubuntu1", "urgency": "low", "distributions": "plucky", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 07 Jan 2025 21:26:01 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.1-1ubuntu1", "urgency": "low", "distributions": "oracular", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 25 Jun 2024 11:33:08 +0200" }, { "cves": [], "log": [ "", " * No change rebuild against libfuse2t64.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu4", "urgency": "high", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 08 Apr 2024 16:38:40 +0200" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 07:33:00 +0000" }, { "cves": [], "log": [ "", " * Make the provides for the renamed packages versioned.", " * Break against the first version not building the t64 packages anymore.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Tue, 12 Mar 2024 21:22:45 +0100" }, { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.4~exp1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Tue, 12 Mar 2024 11:31:16 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2.3ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 04 Mar 2024 08:18:05 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian Unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.47.0-2ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Wed, 26 Jul 2023 13:26:17 -0500" }, { "cves": [], "log": [ "", " * Temporarily disable orphan_file by default, such that fsck from jammy", " can check ext4 created in mantic. Given the new incompat ext4 features", " that v5.15 & hwe kernels support, ideally e2fsprogs 1.47.0 should be", " SRUed into jammy. LP: #2025339", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu2", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [ 2025339 ], "author": "Dimitri John Ledkov ", "date": "Thu, 29 Jun 2023 10:14:32 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Disable the metadata_csum_seed feature again, as grub does not yet", " support it (Closes: #866603)", "" ], "package": "e2fsprogs", "version": "1.47.0-1ubuntu1", "urgency": "low", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 17 Feb 2023 11:58:55 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes (applied in Debian):", " - 0001-tests-support-older-versions-of-timeout-in-r_corrupt", " - CVE-2022-1304.patch", "" ], "package": "e2fsprogs", "version": "1.46.6~rc1-1ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Tue, 22 Nov 2022 15:15:27 +0100" }, { "cves": [ { "cve": "CVE-2022-1304", "url": "https://ubuntu.com/security/CVE-2022-1304", "cve_description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.", "cve_priority": "medium", "cve_public_date": "2022-04-14 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds read/write vulnerability", " Issue leads to segmentation fault and possibly arbitrary code", " execution via a specially crafted filesystem.", " - debian/patches/CVE-2022-1304.patch: checks that all leaf nodes of", " file system contain at least one extent.", " - CVE-2022-1304", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu2", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Mark Esler ", "date": "Thu, 02 Jun 2022 22:03:15 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-2ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 08 Jan 2022 21:02:36 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.5-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Sat, 01 Jan 2022 22:41:06 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.4-1ubuntu1", "urgency": "low", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Wed, 03 Nov 2021 09:32:13 +0100" }, { "cves": [], "log": [ "", " * Restore mke2fs capability to create files adding patch", "", " - mke2fs: fix creating a file system image w/o a pre-existing file", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu3", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Mon, 30 Aug 2021 17:58:29 +0200" }, { "cves": [], "log": [ "", " * Fix failing tests on bigendian system (LP: #1939409)", " using upstream patches queued for 1.46.4:", "", " - e2fsck: fix f_baddotdir failure on big-endian systems", " - libext2fs: fix translation of Posix ACL's on big-endian systems", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1939409 ], "author": "Heinrich Schuchardt ", "date": "Wed, 11 Aug 2021 19:04:33 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian experimental. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.3-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Heinrich Schuchardt ", "date": "Tue, 10 Aug 2021 10:07:26 +0200" }, { "cves": [], "log": [ "", " * Apply upstream fix for unaligned memory access.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu2", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 27 May 2021 13:20:34 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.46.2-1ubuntu1", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 10 May 2021 14:31:18 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to drop the udeb package.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu2", "urgency": "medium", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 22 Feb 2021 10:30:51 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.7-1ubuntu1", "urgency": "low", "distributions": "hirsute", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 29 Jan 2021 12:37:12 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.6-1ubuntu1", "urgency": "low", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 01 May 2020 14:47:58 -0700" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" }, { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", " * Dropped changes, included upstream:", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", "" ], "package": "e2fsprogs", "version": "1.45.5-2ubuntu1", "urgency": "low", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2020 22:08:18 -0800" }, { "cves": [ { "cve": "CVE-2019-5188", "url": "https://ubuntu.com/security/CVE-2019-5188", "cve_description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2020-01-08 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write", " - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted", " directory block when rehashing and don't try to rehash a deleted directory", " in e2fsck/rehash.c, e2fsck/pass1b.c.", " - CVE-2019-5188", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Wed, 22 Jan 2020 12:01:15 -0300" }, { "cves": [ { "cve": "CVE-2019-5094", "url": "https://ubuntu.com/security/CVE-2019-5094", "cve_description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.", "cve_priority": "medium", "cve_public_date": "2019-09-24 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds write on the heap", " - debian/patches/CVE-2019-5094.patch: add checks to prevent", " buffer overrun in quota code in lib/support/quotaio_tree.c,", " lib/support/quotaio_v2.c, lib/support/mkquota.c.", " - CVE-2019-5094", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu2", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Leonidas S. Barbosa ", "date": "Mon, 30 Sep 2019 14:57:59 -0300" }, { "cves": [], "log": [ "", " * Merge with Debian testing, remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf stanzas, so lvm migration", " between non-4k PVs and 4k PVs works regardless of the volume size.", "" ], "package": "e2fsprogs", "version": "1.45.3-4ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Adam Conrad ", "date": "Sun, 08 Sep 2019 04:12:08 -0600" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size.", "" ], "package": "e2fsprogs", "version": "1.45.2-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 24 Jun 2019 11:51:53 +0200" }, { "cves": [], "log": [ "", " * Use 4k blocksize in all ext4 mke2fs.conf such that lvm migration", " between non-4k PVs and 4k PVs works irrespective of the volume", " size. LP: #1817097", "" ], "package": "e2fsprogs", "version": "1.45.1-1ubuntu1", "urgency": "medium", "distributions": "eoan", "launchpad_bugs_fixed": [ 1817097 ], "author": "Dimitri John Ledkov ", "date": "Wed, 15 May 2019 16:15:22 +0200" } ], "notes": null, "is_version_downgrade": true }, { "name": "motd-news-config", "from_version": { "source_package_name": "base-files", "source_package_version": "14.1ubuntu1", "version": "14.1ubuntu1" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu1", "version": "14.2ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2160023, 1472288, 2008088, 683311 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - /etc/issue{,.net}, /etc/os-release: Welcome to Stonking Stingray!", " (LP #2154628)", " - Install locale-check command", " - Include systemd service to check the motd.ubuntu.com service", " - Various bashrc extensions", " - Do not install /usr/local dirs with staff group writeability", " - Add default /etc/networks file", " - Remove the upgrade-available flag on package upgrade", " - Restore order line in /etc/host.conf with a comment", " - Build a motd-news-config package", " - Add update-motd scripts", " - etc/legal: legal notice for Ubuntu", " - add Ubuntu logos and set LOGO=ubuntu-logo in etc/os-release", " * Improve Ubuntu delta:", " - d/rules: Stop installing share/* directly into /usr/share to avoid stray", " duplicate files. Thanks to Finn Rayk Gartner. (LP: #2160023)", " - add RELEASE_TYPE, DOCUMENTATION_URL, VENDOR_NAME, and VENDOR_URL", " to /etc/os-release (LP: #1472288)", " - /etc/dpkg/origins/ubuntu: use https for Vendor-URL", " - update-motd scripts:", " + use os-release (LP: #2008088)", " + fix shellcheck complaints", " - remove maintscript, postinst, and Breaks for moving /e/d/motd-news", " from the base-files to motd-news-config package.", " - remove /etc/lsb-release. lsb-release reads /etc/os-release.", " * debian/base-files.maintscript: remove /etc/lsb-release on upgrades", " * share/profile: quote loop variable (LP: #683311)", "" ], "package": "base-files", "version": "14.2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2160023, 1472288, 2008088, 683311 ], "author": "Benjamin Drung ", "date": "Thu, 23 Jul 2026 18:25:51 +0200" }, { "cves": [], "log": [ "", " * Make it easier for derivatives to change the name of the system.", " Thanks to Arnaud Rebillout. Closes: #1111436.", " * Fix copyright-refers-to-symlink-license lintian warning.", " * Fix missing-field-in-dep5-copyright lintian warning.", " * Drop some unused lintian overrides.", "" ], "package": "base-files", "version": "14.2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Santiago Vila ", "date": "Sun, 31 May 2026 11:20:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "nano", "from_version": { "source_package_name": "nano", "source_package_version": "9.0-1", "version": "9.0-1" }, "to_version": { "source_package_name": "nano", "source_package_version": "9.1-1", "version": "9.1-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * The \"Shajareh Tayyebeh Elementary School\" release.", " * Move to debhelper compat v14.", " * Remove all substvar generated Depends relations, now implicit with dh14.", " * Sync debian/nanorc with upstream nanorc.sample.", "" ], "package": "nano", "version": "9.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Jordi Mallach ", "date": "Wed, 01 Jul 2026 10:42:41 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3", "version": "1:10.2p1-2ubuntu3" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.3p1-4ubuntu1", "version": "1:10.3p1-4ubuntu1" }, "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-3497", "url": "https://ubuntu.com/security/CVE-2026-3497", "cve_description": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.", "cve_priority": "medium", "cve_public_date": "2026-03-12 19:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2155170, 2144812 ], "changes": [ { "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable. (LP: #2155170)", " - Remaining changes:", " - debian/rules: modify dh_installsystemd invocations for", " socket-activated sshd", " - debian/README.Debian: document systemd socket activation.", " - debian/.gitignore: drop file", " - debian/openssh-server.ucf-md5sum: update for Ubuntu delta", " - d/p/systemd-socket-activation.patch:", " + Fix sshd re-execution behavior when socket activation is used", " + Adapt sshd-session and sshd-auth for systemd socket activation", " + Allow AF_VSOCK sockets", " - debian/tests/systemd-socket-activation: Add autopkgtest for systemd", " socket activation functionality.", " - debian/patches: Immediately report interactive instructions to PAM", " clients", " - debian/control: Build-Depends: systemd-dev", " - d/p/sshd-socket-generator.patch: add generator for socket activation", " - debian/openssh-server.install: install sshd-socket-generator", " - debian/openssh-server.postinst: restart whichever systemd unit is", " enabled", " - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator", " - ssh.socket: adjust unit for socket activation by default", " - debian/rules: explicitly enable LTO", " - d/t/ssh-gssapi: disable -e in cleanup()", " - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some", " tests", " - d/openssh-server.links: add full sshd.service -> ssh.service alias", " (LP #2087949)", " - document /etc/ssh/sshd_config.d/*.conf better in sshd_config", " (LP #2088207)", " - d/rules,d/control: do not build with wtmpdb support", " - d/t/control: add breaks-testbed restriction to tests", " - d/tests: do not fail when $HOME/.ssh exists", " - test: workaround test failure caused by uutils dd (LP #2125943)", " - Dropped changes:", " - d/p/gss-api-defaults.patch: Do not default to weak GSS-API exchange", " algorithms.", " + [ Fixed in 1:10.2p1-6 ]", " - d/p/sshconnect2-Write-kbd-interactive-service-info-and-instru.patch:", " Write kbd-interactive service info and instructions as utf-8.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/auth-pam-Add-an-enum-to-define-the-PAM-done-status.patch:", " Add an enum to define the PAM done status.", " + [ Fixed upstream in OpenSSH 10.3p1 (SshPamDone enum) ]", " - d/p/auth-pam-Add-debugging-information-when-we-receive-PAM-me.patch:", " Add debugging information when we receive PAM messages.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/auth-pam-Immediately-report-interactive-instructions-to-c.patch:", " Immediately report interactive instructions to clients.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/CVE-2026-35385.patch, CVE-2026-35386-pre1.patch,", " CVE-2026-35386.patch, CVE-2026-35386-2.patch,", " CVE-2026-35387_35414.patch, CVE-2026-35388.patch:", " Security fixes for CVE-2026-35385, CVE-2026-35386,", " CVE-2026-35387, CVE-2026-35388, CVE-2026-35414.", " + [ All fixed upstream in OpenSSH 10.3p1. ]", "" ], "package": "openssh", "version": "1:10.3p1-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2155170 ], "author": "Grayson Wolf ", "date": "Mon, 08 Jun 2026 09:58:34 -0400" }, { "cves": [], "log": [ "", " * OpenSSL 4 removed support for engines, so only configure with", " --with-ssl-engine when building for older versions (closes: #1138423).", "" ], "package": "openssh", "version": "1:10.3p1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 01 Jun 2026 11:37:05 +0100" }, { "cves": [], "log": [ "", " * Enable regression tests of keyboard-interactive and password", " authentication.", " * Add test dependency on procps for pidof (closes: #1136545).", "" ], "package": "openssh", "version": "1:10.3p1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 29 May 2026 10:00:29 +0100" }, { "cves": [], "log": [ "", " * Correctly set extended type for client-side channels. Fixes interactive", " vs bulk IPQoS for client->server traffic.", " * Build-depend on libselinux-dev rather than libselinux1-dev.", "" ], "package": "openssh", "version": "1:10.3p1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 03 May 2026 17:28:29 +0100" }, { "cves": [ { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" } ], "log": [ "", " * New upstream release:", " - CVE-2026-35386: ssh(1): validation of shell metacharacters in user", " names supplied on the command-line was performed too late to prevent", " some situations where they could be expanded from %-tokens in", " ssh_config. For certain configurations, such as those that use a \"%u\"", " token in a \"Match exec\" block, an attacker who can control the user", " name passed to ssh(1) could potentially execute arbitrary shell", " commands. Reported by Florian Kohnhäuser (closes: #1132573).", " We continue to recommend against directly exposing ssh(1) and other", " tools' command-lines to untrusted input. Mitigations such as this can", " not be absolute given the variety of shells and user configurations in", " use.", " - CVE-2026-35414: sshd(8): when matching an authorized_keys", " principals=\"\" option against a list of principals in a certificate, an", " incorrect algorithm was used that could allow inappropriate matching", " in cases where a principal name in the certificate contains a comma", " character. Exploitation of the condition requires an authorized_keys", " principals=\"\" option that lists more than one principal *and* a CA", " that will issue a certificate that encodes more than one of these", " principal names separated by a comma (typical CAs strongly constrain", " which principal names they will place in a certificate). This", " condition only applies to user- trusted CA keys in authorized_keys,", " the main certificate authentication path", " (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported", " by Vladimir Tokarev (closes: #1132576).", " - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O)", " mode and without the -p (preserve modes) flag set, scp did not clear", " setuid/setgid bits from downloaded files as one might typically", " expect. This bug dates back to the original Berkeley rcp program.", " Reported by Christos Papakonstantinou of Cantina and Spearbit (closes:", " #1132572).", " - CVE-2026-35387: sshd(8): fix incomplete application of", " PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard", " to ECDSA keys. Previously if one of these directives contains any", " ECDSA algorithm name (say \"ecdsa-sha2-nistp384\"), then any other ECDSA", " algorithm would be accepted in its place regardless of whether it was", " listed or not. Reported by Christos Papakonstantinou of Cantina and", " Spearbit (closes: #1132574).", " - CVE-2026-35388: ssh(1): connection multiplexing confirmation", " (requested using \"ControlMaster ask/autoask\") was not being tested for", " proxy mode multiplexing sessions (i.e. \"ssh -O proxy ...\"). Reported", " by Michalis Vasileiadis (closes: #1132575).", " - ssh(1), sshd(8): support IANA-assigned codepoints for SSH agent", " forwarding, as per draft-ietf-sshm-ssh-agent. Support for the new", " names is advertised via the EXT_INFO message. If a server offers", " support for the new names, then they are used preferentially. Support", " for the pre-standardisation \"@openssh.com\" extensions for agent", " forwarding remains supported.", " - ssh-agent(1): implement support for draft-ietf-sshm-ssh-agent \"query\"", " extension.", " - ssh-add(1): support querying the protocol extensions via the agent", " \"query\" extension with a new -Q flag.", " - ssh(1): support multiple files in a ssh_config RevokedHostKeys", " directive.", " - sshd(8): support multiple files in a sshd_config RevokedKeys", " directive.", " - ssh(1): add a ~I escape option that shows information about the", " current SSH connection (closes: #321525).", " - ssh(1): add an \"ssh -Oconninfo user@host\" multiplexing command that", " shows connection information, similar to the ~I escapechar.", " - ssh(1): add an \"ssh -O channels user@host\" multiplexing command to get", " a running mux process to show information about what channels are", " currently open.", " - sshd(8): add 'invaliduser' penalty to PerSourcePenalties, which is", " applied to login attempts for usernames that do not match real", " accounts. Defaults to 5s to match 'authfail' but allows administrators", " to block such attempts for longer if desired.", " - sshd(8): add a GSSAPIDelegateCredentials option for the server,", " controlling whether it accepts delegated credentials offered by the", " client. This option mirrors the same option in ssh_config.", " - ssh(1), sshd(8): support the VA DSCP codepoint in the IPQoS directive.", " - sshd(8): convert PerSourcePenalties to using floating point time,", " allowing penalties to be less than a second. This is useful if you", " need to penalise things you expect to occur at >=1 QPS.", " - ssh-keygen(1): support writing ED25519 keys in PKCS8 format.", " - Support the ed25519 signature scheme via libcrypto.", " - sshd(8): make IPQoS first-match-wins in sshd_config, like other", " configuration directives.", " - sshd(8): fix potential crash when MaxStartups is using a single", " argument (i.e. not using the MaxStartups x:y:z form) to a value below", " 10.", " - sshd(8): fix a potential hang during key exchange if needed DH group", " values were missing from /etc/moduli.", " - ssh-agent(1): fix return values from extensions to be correct wrt", " draft-ietf-sshm-ssh-agent: extension requests should indicate failure", " using SSH_AGENT_EXTENSION_FAILURE rather than the generic", " SSH_AGENT_FAILURE error code. This allows the client to discern", " between \"the request failed\" and \"the agent doesn't support this", " extension\".", " - ssh(1): use fmprintf for showing challenge-response name and info to", " preserve UTF-8 characters where appropriate.", " - scp(1): when uploading a directory using sftp/sftp (e.g. during a", " recursive transfer), don't clobber the remote directory permissions", " unless either we created the directory during the transfer or the -p", " flag was set.", " - All: implement missing pieces of FIDO/webauthn signature support,", " mostly related to certificate handling and enable acceptance of this", " signature format by default.", " - sshd_config(5): make it clear that DenyUsers/DenyGroups overrides", " AllowUsers/AllowGroups. Previously we specified the order in which the", " directives are processed but it was ambiguous as to what happened if", " both matched.", " - ssh(1): don't try to match certificates held in an agent to private", " keys. This matching is done to support certificates that were loaded", " without their private key material, but is unnecessary for", " agent-hosted certificate which always have private key material", " available in the agent. Worse, this matching would mess up the request", " sent to the agent in such a way as to break usage of these keys when", " the key usage was restricted in the agent.", " - sftp(1): if editline has been switched to vi mode (i.e. via \"bind -v\"", " in .editrc), setup a keybinding so that command mode can be entered.", " - ssh(1), sshd(8): improve performance of keying the sntrup761 key", " agreement algorithm.", " - ssh(1), sshd(8): enforce maximum packet/block limit during", " pre-authentication phase.", " - sftp(1): don't misuse the sftp limits extension's open-handles field.", " This value is supposed to be the number of handles a server will allow", " to be opened and not a number of outstanding read/write requests that", " can be sent during an upload/download.", " - sshd(8): don't crash at connection time if the main sshd_config lacks", " any subsystem directive but one is defined in a Match block.", " - sshd_config(5): add a warning next to the ForceCommand directive that", " forcing a command doesn't automatically disable forwarding.", " - sshd_config(5): add a warning that TOKENS are replaced without", " filtering or escaping and that it's the administrator's responsibility", " to ensure they are used safely in context.", " - sshd(8): don't mess up the PerSourceNetBlockSize IPv6 mask if sscanf", " didn't decode it.", " - ssh-add(1): when loading FIDO2 resident keys, set the comment to the", " FIDO application string. This matches the behaviour of ssh-keygen -K.", " - sshd(8): don't strnvis() log messages that are going to be logged by", " sshd-auth via its parent sshd-session process, as the parent will also", " run them though strnvis(). Prevents double-escaping of non-printing", " characters in some log messages.", " - ssh-agent(1): escape SSH_AUTH_SOCK paths that are sent to the shell as", " setenv commands. Unbreaks ssh-agent for home directory paths that", " contain whitespace (closes: #1118288).", " - All: Remove unnecessary checks for ECDSA public key validity.", " - sshd(8): activate UnusedConnectionTimeout only after the last channel", " has closed. Previously UnusedConnectionTimeout could fire early after", " a ChannelTimeout. This was not a problem for the OpenSSH client", " because it terminates once all channels have closed but could cause", " problems for other clients (e.g. API clients) that do things", " differently.", " - scp(1): when using the SFTP protocol for transfers, fix implicit", " destination path selection when source path ends with \"..\".", " - sftp(1): when tab-completing a filename, ensure that the completed", " string does not end up mid-way through a multibyte character, as this", " will cause a fatal() later on.", " - ssh-keygen(1): fix crash at exit (visible via ssh-keygen -D) when", " multiple keys loaded.", " - scp(1)/sftp(1): correctly display bandwidths >2GBps in the progress", " meter.", " - sshd(8): fix condition introduced in openssh 10.2p1 stable branch", " where a PAM module that changed the requested username between", " SSH_MSG_USERAUTH_REQUEST messages during authentication could confuse", " the PAM stack and let it proceed with a different understanding of the", " active username than the rest of sshd. Reported by Mike Damm.", " - sshd(8): immediately report interactive instructions to clients when", " using keyboard-interactive authentication with PAM.", " - sshd(8): fix duplicate PAM messages under some situations.", " - sshd(8): don't leak PAM handle on repeat invocations.", " - sshd(8): fix ut_type for btmp records, correctly using LOGIN_PROCESS", " and USER_PROCESS.", " - sshd(8): allow uname(3) in the seccomp sandbox. This is needed by", " zlib-ng on RISC-V platforms.", " - All: remove remaining OpenSSL_add_all_algorithms() calls. We already", " have OPENSSL_init_crypto() in the compat layer.", "" ], "package": "openssh", "version": "1:10.3p1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 12 Apr 2026 12:49:45 +0100" }, { "cves": [ { "cve": "CVE-2026-3497", "url": "https://ubuntu.com/security/CVE-2026-3497", "cve_description": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.", "cve_priority": "medium", "cve_public_date": "2026-03-12 19:16:00 UTC" } ], "log": [ "", " * CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect", " use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly", " initialize some variables (closes: #1130595; thanks, Marc Deslauriers).", " * Do not default to weak GSS-API exchange algorithms (closes: #989906,", " #1131206; LP: #2144812; thanks, Athos Ribeiro).", "" ], "package": "openssh", "version": "1:10.2p1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2144812 ], "author": "Colin Watson ", "date": "Fri, 27 Mar 2026 18:26:06 +0000" }, { "cves": [], "log": [ "", " [ Samuel Thibault ]", " * Do not link against libcrypt on GNU/Hurd (closes: #1128399).", "", " [ Colin Watson ]", " * Install systemd files directly to /usr and drop dh-sequence-movetousr", " (closes: #1122765).", "" ], "package": "openssh", "version": "1:10.2p1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 19 Feb 2026 10:46:15 +0000" }, { "cves": [], "log": [ "", " [ Colin Watson ]", " * Debconf translations:", " - Simplified and Traditional Chinese (thanks, Yangfl; closes: #1124970).", "", " [ Luca Boccassi ]", " * openssh-client: use sysusers.d instead of manual scripting.", " * openssh-client: drop compat postinst not needed since bookworm/noble.", " * openssh-client: drop versioned dependency on i-s-h, satisfied since", " trixie/noble.", " * openssh-client: drop dependency on passwd, add recommends on", " openssh-server.", " * Use dh-sequence-installsysusers and drop d/rules override.", "", " [ Christian Göttsche ]", " * Reorder pam_selinux(7) usage (closes: #747303).", "" ], "package": "openssh", "version": "1:10.2p1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 18 Feb 2026 14:09:13 +0000" }, { "cves": [], "log": [ "", " * Drop \"Rules-Requires-Root: no\", default as of dpkg-dev 1.22.13.", " * Drop openssh-server's dependency on lsb-base.", " * Remove support for direct upgrades from before Debian 12 (bookworm).", " * Rewrite scp-quoting.patch using argv_assemble, and forward it upstream.", "" ], "package": "openssh", "version": "1:10.2p1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 02 Dec 2025 14:36:37 +0000" }, { "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: unexpected scp setuid and setgid", " - debian/patches/CVE-2026-35385.patch: clear setuid/setgid bits from", " downloaded files in scp.c.", " - CVE-2026-35385", " * SECURITY UPDATE: command execution via shell metacharacters in username", " - debian/patches/CVE-2026-35386-pre1.patch: apply validity rules on", " ProxyJump usernames and hostnames in readconf.c, readconf.h, ssh.c.", " - debian/patches/CVE-2026-35386.patch: move username check earlier in", " ssh.c.", " - debian/patches/CVE-2026-35386-2.patch: adapt to username validity", " check change in regress/percent.sh.", " - CVE-2026-35386", " * SECURITY UPDATE: use of unintended ECDSA algorithms", " - debian/patches/CVE-2026-35387_35414.patch: correctly match ECDSA", " signature algorithms against algorithm allowlists in", " auth2-hostbased.c, auth2-pubkey.c, sshconnect2.c.", " - CVE-2026-35387", " * SECURITY UPDATE: missing connection multiplexing confirmation", " - debian/patches/CVE-2026-35388.patch: add missing askpass check in", " mux.c.", " - CVE-2026-35388", " * SECURITY UPDATE: authorized_keys principals option mishandling", " - debian/patches/CVE-2026-35387_35414.patch: check for commas in", " auth2-pubkeyfile.c.", " - CVE-2026-35414", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 27 Apr 2026 20:15:40 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3", "version": "1:10.2p1-2ubuntu3" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.3p1-4ubuntu1", "version": "1:10.3p1-4ubuntu1" }, "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-3497", "url": "https://ubuntu.com/security/CVE-2026-3497", "cve_description": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.", "cve_priority": "medium", "cve_public_date": "2026-03-12 19:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2155170, 2144812 ], "changes": [ { "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable. (LP: #2155170)", " - Remaining changes:", " - debian/rules: modify dh_installsystemd invocations for", " socket-activated sshd", " - debian/README.Debian: document systemd socket activation.", " - debian/.gitignore: drop file", " - debian/openssh-server.ucf-md5sum: update for Ubuntu delta", " - d/p/systemd-socket-activation.patch:", " + Fix sshd re-execution behavior when socket activation is used", " + Adapt sshd-session and sshd-auth for systemd socket activation", " + Allow AF_VSOCK sockets", " - debian/tests/systemd-socket-activation: Add autopkgtest for systemd", " socket activation functionality.", " - debian/patches: Immediately report interactive instructions to PAM", " clients", " - debian/control: Build-Depends: systemd-dev", " - d/p/sshd-socket-generator.patch: add generator for socket activation", " - debian/openssh-server.install: install sshd-socket-generator", " - debian/openssh-server.postinst: restart whichever systemd unit is", " enabled", " - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator", " - ssh.socket: adjust unit for socket activation by default", " - debian/rules: explicitly enable LTO", " - d/t/ssh-gssapi: disable -e in cleanup()", " - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some", " tests", " - d/openssh-server.links: add full sshd.service -> ssh.service alias", " (LP #2087949)", " - document /etc/ssh/sshd_config.d/*.conf better in sshd_config", " (LP #2088207)", " - d/rules,d/control: do not build with wtmpdb support", " - d/t/control: add breaks-testbed restriction to tests", " - d/tests: do not fail when $HOME/.ssh exists", " - test: workaround test failure caused by uutils dd (LP #2125943)", " - Dropped changes:", " - d/p/gss-api-defaults.patch: Do not default to weak GSS-API exchange", " algorithms.", " + [ Fixed in 1:10.2p1-6 ]", " - d/p/sshconnect2-Write-kbd-interactive-service-info-and-instru.patch:", " Write kbd-interactive service info and instructions as utf-8.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/auth-pam-Add-an-enum-to-define-the-PAM-done-status.patch:", " Add an enum to define the PAM done status.", " + [ Fixed upstream in OpenSSH 10.3p1 (SshPamDone enum) ]", " - d/p/auth-pam-Add-debugging-information-when-we-receive-PAM-me.patch:", " Add debugging information when we receive PAM messages.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/auth-pam-Immediately-report-interactive-instructions-to-c.patch:", " Immediately report interactive instructions to clients.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/CVE-2026-35385.patch, CVE-2026-35386-pre1.patch,", " CVE-2026-35386.patch, CVE-2026-35386-2.patch,", " CVE-2026-35387_35414.patch, CVE-2026-35388.patch:", " Security fixes for CVE-2026-35385, CVE-2026-35386,", " CVE-2026-35387, CVE-2026-35388, CVE-2026-35414.", " + [ All fixed upstream in OpenSSH 10.3p1. ]", "" ], "package": "openssh", "version": "1:10.3p1-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2155170 ], "author": "Grayson Wolf ", "date": "Mon, 08 Jun 2026 09:58:34 -0400" }, { "cves": [], "log": [ "", " * OpenSSL 4 removed support for engines, so only configure with", " --with-ssl-engine when building for older versions (closes: #1138423).", "" ], "package": "openssh", "version": "1:10.3p1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 01 Jun 2026 11:37:05 +0100" }, { "cves": [], "log": [ "", " * Enable regression tests of keyboard-interactive and password", " authentication.", " * Add test dependency on procps for pidof (closes: #1136545).", "" ], "package": "openssh", "version": "1:10.3p1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 29 May 2026 10:00:29 +0100" }, { "cves": [], "log": [ "", " * Correctly set extended type for client-side channels. Fixes interactive", " vs bulk IPQoS for client->server traffic.", " * Build-depend on libselinux-dev rather than libselinux1-dev.", "" ], "package": "openssh", "version": "1:10.3p1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 03 May 2026 17:28:29 +0100" }, { "cves": [ { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" } ], "log": [ "", " * New upstream release:", " - CVE-2026-35386: ssh(1): validation of shell metacharacters in user", " names supplied on the command-line was performed too late to prevent", " some situations where they could be expanded from %-tokens in", " ssh_config. For certain configurations, such as those that use a \"%u\"", " token in a \"Match exec\" block, an attacker who can control the user", " name passed to ssh(1) could potentially execute arbitrary shell", " commands. Reported by Florian Kohnhäuser (closes: #1132573).", " We continue to recommend against directly exposing ssh(1) and other", " tools' command-lines to untrusted input. Mitigations such as this can", " not be absolute given the variety of shells and user configurations in", " use.", " - CVE-2026-35414: sshd(8): when matching an authorized_keys", " principals=\"\" option against a list of principals in a certificate, an", " incorrect algorithm was used that could allow inappropriate matching", " in cases where a principal name in the certificate contains a comma", " character. Exploitation of the condition requires an authorized_keys", " principals=\"\" option that lists more than one principal *and* a CA", " that will issue a certificate that encodes more than one of these", " principal names separated by a comma (typical CAs strongly constrain", " which principal names they will place in a certificate). This", " condition only applies to user- trusted CA keys in authorized_keys,", " the main certificate authentication path", " (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported", " by Vladimir Tokarev (closes: #1132576).", " - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O)", " mode and without the -p (preserve modes) flag set, scp did not clear", " setuid/setgid bits from downloaded files as one might typically", " expect. This bug dates back to the original Berkeley rcp program.", " Reported by Christos Papakonstantinou of Cantina and Spearbit (closes:", " #1132572).", " - CVE-2026-35387: sshd(8): fix incomplete application of", " PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard", " to ECDSA keys. Previously if one of these directives contains any", " ECDSA algorithm name (say \"ecdsa-sha2-nistp384\"), then any other ECDSA", " algorithm would be accepted in its place regardless of whether it was", " listed or not. Reported by Christos Papakonstantinou of Cantina and", " Spearbit (closes: #1132574).", " - CVE-2026-35388: ssh(1): connection multiplexing confirmation", " (requested using \"ControlMaster ask/autoask\") was not being tested for", " proxy mode multiplexing sessions (i.e. \"ssh -O proxy ...\"). Reported", " by Michalis Vasileiadis (closes: #1132575).", " - ssh(1), sshd(8): support IANA-assigned codepoints for SSH agent", " forwarding, as per draft-ietf-sshm-ssh-agent. Support for the new", " names is advertised via the EXT_INFO message. If a server offers", " support for the new names, then they are used preferentially. Support", " for the pre-standardisation \"@openssh.com\" extensions for agent", " forwarding remains supported.", " - ssh-agent(1): implement support for draft-ietf-sshm-ssh-agent \"query\"", " extension.", " - ssh-add(1): support querying the protocol extensions via the agent", " \"query\" extension with a new -Q flag.", " - ssh(1): support multiple files in a ssh_config RevokedHostKeys", " directive.", " - sshd(8): support multiple files in a sshd_config RevokedKeys", " directive.", " - ssh(1): add a ~I escape option that shows information about the", " current SSH connection (closes: #321525).", " - ssh(1): add an \"ssh -Oconninfo user@host\" multiplexing command that", " shows connection information, similar to the ~I escapechar.", " - ssh(1): add an \"ssh -O channels user@host\" multiplexing command to get", " a running mux process to show information about what channels are", " currently open.", " - sshd(8): add 'invaliduser' penalty to PerSourcePenalties, which is", " applied to login attempts for usernames that do not match real", " accounts. Defaults to 5s to match 'authfail' but allows administrators", " to block such attempts for longer if desired.", " - sshd(8): add a GSSAPIDelegateCredentials option for the server,", " controlling whether it accepts delegated credentials offered by the", " client. This option mirrors the same option in ssh_config.", " - ssh(1), sshd(8): support the VA DSCP codepoint in the IPQoS directive.", " - sshd(8): convert PerSourcePenalties to using floating point time,", " allowing penalties to be less than a second. This is useful if you", " need to penalise things you expect to occur at >=1 QPS.", " - ssh-keygen(1): support writing ED25519 keys in PKCS8 format.", " - Support the ed25519 signature scheme via libcrypto.", " - sshd(8): make IPQoS first-match-wins in sshd_config, like other", " configuration directives.", " - sshd(8): fix potential crash when MaxStartups is using a single", " argument (i.e. not using the MaxStartups x:y:z form) to a value below", " 10.", " - sshd(8): fix a potential hang during key exchange if needed DH group", " values were missing from /etc/moduli.", " - ssh-agent(1): fix return values from extensions to be correct wrt", " draft-ietf-sshm-ssh-agent: extension requests should indicate failure", " using SSH_AGENT_EXTENSION_FAILURE rather than the generic", " SSH_AGENT_FAILURE error code. This allows the client to discern", " between \"the request failed\" and \"the agent doesn't support this", " extension\".", " - ssh(1): use fmprintf for showing challenge-response name and info to", " preserve UTF-8 characters where appropriate.", " - scp(1): when uploading a directory using sftp/sftp (e.g. during a", " recursive transfer), don't clobber the remote directory permissions", " unless either we created the directory during the transfer or the -p", " flag was set.", " - All: implement missing pieces of FIDO/webauthn signature support,", " mostly related to certificate handling and enable acceptance of this", " signature format by default.", " - sshd_config(5): make it clear that DenyUsers/DenyGroups overrides", " AllowUsers/AllowGroups. Previously we specified the order in which the", " directives are processed but it was ambiguous as to what happened if", " both matched.", " - ssh(1): don't try to match certificates held in an agent to private", " keys. This matching is done to support certificates that were loaded", " without their private key material, but is unnecessary for", " agent-hosted certificate which always have private key material", " available in the agent. Worse, this matching would mess up the request", " sent to the agent in such a way as to break usage of these keys when", " the key usage was restricted in the agent.", " - sftp(1): if editline has been switched to vi mode (i.e. via \"bind -v\"", " in .editrc), setup a keybinding so that command mode can be entered.", " - ssh(1), sshd(8): improve performance of keying the sntrup761 key", " agreement algorithm.", " - ssh(1), sshd(8): enforce maximum packet/block limit during", " pre-authentication phase.", " - sftp(1): don't misuse the sftp limits extension's open-handles field.", " This value is supposed to be the number of handles a server will allow", " to be opened and not a number of outstanding read/write requests that", " can be sent during an upload/download.", " - sshd(8): don't crash at connection time if the main sshd_config lacks", " any subsystem directive but one is defined in a Match block.", " - sshd_config(5): add a warning next to the ForceCommand directive that", " forcing a command doesn't automatically disable forwarding.", " - sshd_config(5): add a warning that TOKENS are replaced without", " filtering or escaping and that it's the administrator's responsibility", " to ensure they are used safely in context.", " - sshd(8): don't mess up the PerSourceNetBlockSize IPv6 mask if sscanf", " didn't decode it.", " - ssh-add(1): when loading FIDO2 resident keys, set the comment to the", " FIDO application string. This matches the behaviour of ssh-keygen -K.", " - sshd(8): don't strnvis() log messages that are going to be logged by", " sshd-auth via its parent sshd-session process, as the parent will also", " run them though strnvis(). Prevents double-escaping of non-printing", " characters in some log messages.", " - ssh-agent(1): escape SSH_AUTH_SOCK paths that are sent to the shell as", " setenv commands. Unbreaks ssh-agent for home directory paths that", " contain whitespace (closes: #1118288).", " - All: Remove unnecessary checks for ECDSA public key validity.", " - sshd(8): activate UnusedConnectionTimeout only after the last channel", " has closed. Previously UnusedConnectionTimeout could fire early after", " a ChannelTimeout. This was not a problem for the OpenSSH client", " because it terminates once all channels have closed but could cause", " problems for other clients (e.g. API clients) that do things", " differently.", " - scp(1): when using the SFTP protocol for transfers, fix implicit", " destination path selection when source path ends with \"..\".", " - sftp(1): when tab-completing a filename, ensure that the completed", " string does not end up mid-way through a multibyte character, as this", " will cause a fatal() later on.", " - ssh-keygen(1): fix crash at exit (visible via ssh-keygen -D) when", " multiple keys loaded.", " - scp(1)/sftp(1): correctly display bandwidths >2GBps in the progress", " meter.", " - sshd(8): fix condition introduced in openssh 10.2p1 stable branch", " where a PAM module that changed the requested username between", " SSH_MSG_USERAUTH_REQUEST messages during authentication could confuse", " the PAM stack and let it proceed with a different understanding of the", " active username than the rest of sshd. Reported by Mike Damm.", " - sshd(8): immediately report interactive instructions to clients when", " using keyboard-interactive authentication with PAM.", " - sshd(8): fix duplicate PAM messages under some situations.", " - sshd(8): don't leak PAM handle on repeat invocations.", " - sshd(8): fix ut_type for btmp records, correctly using LOGIN_PROCESS", " and USER_PROCESS.", " - sshd(8): allow uname(3) in the seccomp sandbox. This is needed by", " zlib-ng on RISC-V platforms.", " - All: remove remaining OpenSSL_add_all_algorithms() calls. We already", " have OPENSSL_init_crypto() in the compat layer.", "" ], "package": "openssh", "version": "1:10.3p1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 12 Apr 2026 12:49:45 +0100" }, { "cves": [ { "cve": "CVE-2026-3497", "url": "https://ubuntu.com/security/CVE-2026-3497", "cve_description": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.", "cve_priority": "medium", "cve_public_date": "2026-03-12 19:16:00 UTC" } ], "log": [ "", " * CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect", " use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly", " initialize some variables (closes: #1130595; thanks, Marc Deslauriers).", " * Do not default to weak GSS-API exchange algorithms (closes: #989906,", " #1131206; LP: #2144812; thanks, Athos Ribeiro).", "" ], "package": "openssh", "version": "1:10.2p1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2144812 ], "author": "Colin Watson ", "date": "Fri, 27 Mar 2026 18:26:06 +0000" }, { "cves": [], "log": [ "", " [ Samuel Thibault ]", " * Do not link against libcrypt on GNU/Hurd (closes: #1128399).", "", " [ Colin Watson ]", " * Install systemd files directly to /usr and drop dh-sequence-movetousr", " (closes: #1122765).", "" ], "package": "openssh", "version": "1:10.2p1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 19 Feb 2026 10:46:15 +0000" }, { "cves": [], "log": [ "", " [ Colin Watson ]", " * Debconf translations:", " - Simplified and Traditional Chinese (thanks, Yangfl; closes: #1124970).", "", " [ Luca Boccassi ]", " * openssh-client: use sysusers.d instead of manual scripting.", " * openssh-client: drop compat postinst not needed since bookworm/noble.", " * openssh-client: drop versioned dependency on i-s-h, satisfied since", " trixie/noble.", " * openssh-client: drop dependency on passwd, add recommends on", " openssh-server.", " * Use dh-sequence-installsysusers and drop d/rules override.", "", " [ Christian Göttsche ]", " * Reorder pam_selinux(7) usage (closes: #747303).", "" ], "package": "openssh", "version": "1:10.2p1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 18 Feb 2026 14:09:13 +0000" }, { "cves": [], "log": [ "", " * Drop \"Rules-Requires-Root: no\", default as of dpkg-dev 1.22.13.", " * Drop openssh-server's dependency on lsb-base.", " * Remove support for direct upgrades from before Debian 12 (bookworm).", " * Rewrite scp-quoting.patch using argv_assemble, and forward it upstream.", "" ], "package": "openssh", "version": "1:10.2p1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 02 Dec 2025 14:36:37 +0000" }, { "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: unexpected scp setuid and setgid", " - debian/patches/CVE-2026-35385.patch: clear setuid/setgid bits from", " downloaded files in scp.c.", " - CVE-2026-35385", " * SECURITY UPDATE: command execution via shell metacharacters in username", " - debian/patches/CVE-2026-35386-pre1.patch: apply validity rules on", " ProxyJump usernames and hostnames in readconf.c, readconf.h, ssh.c.", " - debian/patches/CVE-2026-35386.patch: move username check earlier in", " ssh.c.", " - debian/patches/CVE-2026-35386-2.patch: adapt to username validity", " check change in regress/percent.sh.", " - CVE-2026-35386", " * SECURITY UPDATE: use of unintended ECDSA algorithms", " - debian/patches/CVE-2026-35387_35414.patch: correctly match ECDSA", " signature algorithms against algorithm allowlists in", " auth2-hostbased.c, auth2-pubkey.c, sshconnect2.c.", " - CVE-2026-35387", " * SECURITY UPDATE: missing connection multiplexing confirmation", " - debian/patches/CVE-2026-35388.patch: add missing askpass check in", " mux.c.", " - CVE-2026-35388", " * SECURITY UPDATE: authorized_keys principals option mishandling", " - debian/patches/CVE-2026-35387_35414.patch: check for commas in", " auth2-pubkeyfile.c.", " - CVE-2026-35414", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 27 Apr 2026 20:15:40 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3", "version": "1:10.2p1-2ubuntu3" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.3p1-4ubuntu1", "version": "1:10.3p1-4ubuntu1" }, "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-3497", "url": "https://ubuntu.com/security/CVE-2026-3497", "cve_description": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.", "cve_priority": "medium", "cve_public_date": "2026-03-12 19:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2155170, 2144812 ], "changes": [ { "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable. (LP: #2155170)", " - Remaining changes:", " - debian/rules: modify dh_installsystemd invocations for", " socket-activated sshd", " - debian/README.Debian: document systemd socket activation.", " - debian/.gitignore: drop file", " - debian/openssh-server.ucf-md5sum: update for Ubuntu delta", " - d/p/systemd-socket-activation.patch:", " + Fix sshd re-execution behavior when socket activation is used", " + Adapt sshd-session and sshd-auth for systemd socket activation", " + Allow AF_VSOCK sockets", " - debian/tests/systemd-socket-activation: Add autopkgtest for systemd", " socket activation functionality.", " - debian/patches: Immediately report interactive instructions to PAM", " clients", " - debian/control: Build-Depends: systemd-dev", " - d/p/sshd-socket-generator.patch: add generator for socket activation", " - debian/openssh-server.install: install sshd-socket-generator", " - debian/openssh-server.postinst: restart whichever systemd unit is", " enabled", " - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator", " - ssh.socket: adjust unit for socket activation by default", " - debian/rules: explicitly enable LTO", " - d/t/ssh-gssapi: disable -e in cleanup()", " - d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some", " tests", " - d/openssh-server.links: add full sshd.service -> ssh.service alias", " (LP #2087949)", " - document /etc/ssh/sshd_config.d/*.conf better in sshd_config", " (LP #2088207)", " - d/rules,d/control: do not build with wtmpdb support", " - d/t/control: add breaks-testbed restriction to tests", " - d/tests: do not fail when $HOME/.ssh exists", " - test: workaround test failure caused by uutils dd (LP #2125943)", " - Dropped changes:", " - d/p/gss-api-defaults.patch: Do not default to weak GSS-API exchange", " algorithms.", " + [ Fixed in 1:10.2p1-6 ]", " - d/p/sshconnect2-Write-kbd-interactive-service-info-and-instru.patch:", " Write kbd-interactive service info and instructions as utf-8.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/auth-pam-Add-an-enum-to-define-the-PAM-done-status.patch:", " Add an enum to define the PAM done status.", " + [ Fixed upstream in OpenSSH 10.3p1 (SshPamDone enum) ]", " - d/p/auth-pam-Add-debugging-information-when-we-receive-PAM-me.patch:", " Add debugging information when we receive PAM messages.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/auth-pam-Immediately-report-interactive-instructions-to-c.patch:", " Immediately report interactive instructions to clients.", " + [ Fixed upstream in OpenSSH 10.3p1. ]", " - d/p/CVE-2026-35385.patch, CVE-2026-35386-pre1.patch,", " CVE-2026-35386.patch, CVE-2026-35386-2.patch,", " CVE-2026-35387_35414.patch, CVE-2026-35388.patch:", " Security fixes for CVE-2026-35385, CVE-2026-35386,", " CVE-2026-35387, CVE-2026-35388, CVE-2026-35414.", " + [ All fixed upstream in OpenSSH 10.3p1. ]", "" ], "package": "openssh", "version": "1:10.3p1-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2155170 ], "author": "Grayson Wolf ", "date": "Mon, 08 Jun 2026 09:58:34 -0400" }, { "cves": [], "log": [ "", " * OpenSSL 4 removed support for engines, so only configure with", " --with-ssl-engine when building for older versions (closes: #1138423).", "" ], "package": "openssh", "version": "1:10.3p1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 01 Jun 2026 11:37:05 +0100" }, { "cves": [], "log": [ "", " * Enable regression tests of keyboard-interactive and password", " authentication.", " * Add test dependency on procps for pidof (closes: #1136545).", "" ], "package": "openssh", "version": "1:10.3p1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 29 May 2026 10:00:29 +0100" }, { "cves": [], "log": [ "", " * Correctly set extended type for client-side channels. Fixes interactive", " vs bulk IPQoS for client->server traffic.", " * Build-depend on libselinux-dev rather than libselinux1-dev.", "" ], "package": "openssh", "version": "1:10.3p1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 03 May 2026 17:28:29 +0100" }, { "cves": [ { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" }, { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" } ], "log": [ "", " * New upstream release:", " - CVE-2026-35386: ssh(1): validation of shell metacharacters in user", " names supplied on the command-line was performed too late to prevent", " some situations where they could be expanded from %-tokens in", " ssh_config. For certain configurations, such as those that use a \"%u\"", " token in a \"Match exec\" block, an attacker who can control the user", " name passed to ssh(1) could potentially execute arbitrary shell", " commands. Reported by Florian Kohnhäuser (closes: #1132573).", " We continue to recommend against directly exposing ssh(1) and other", " tools' command-lines to untrusted input. Mitigations such as this can", " not be absolute given the variety of shells and user configurations in", " use.", " - CVE-2026-35414: sshd(8): when matching an authorized_keys", " principals=\"\" option against a list of principals in a certificate, an", " incorrect algorithm was used that could allow inappropriate matching", " in cases where a principal name in the certificate contains a comma", " character. Exploitation of the condition requires an authorized_keys", " principals=\"\" option that lists more than one principal *and* a CA", " that will issue a certificate that encodes more than one of these", " principal names separated by a comma (typical CAs strongly constrain", " which principal names they will place in a certificate). This", " condition only applies to user- trusted CA keys in authorized_keys,", " the main certificate authentication path", " (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported", " by Vladimir Tokarev (closes: #1132576).", " - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O)", " mode and without the -p (preserve modes) flag set, scp did not clear", " setuid/setgid bits from downloaded files as one might typically", " expect. This bug dates back to the original Berkeley rcp program.", " Reported by Christos Papakonstantinou of Cantina and Spearbit (closes:", " #1132572).", " - CVE-2026-35387: sshd(8): fix incomplete application of", " PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard", " to ECDSA keys. Previously if one of these directives contains any", " ECDSA algorithm name (say \"ecdsa-sha2-nistp384\"), then any other ECDSA", " algorithm would be accepted in its place regardless of whether it was", " listed or not. Reported by Christos Papakonstantinou of Cantina and", " Spearbit (closes: #1132574).", " - CVE-2026-35388: ssh(1): connection multiplexing confirmation", " (requested using \"ControlMaster ask/autoask\") was not being tested for", " proxy mode multiplexing sessions (i.e. \"ssh -O proxy ...\"). Reported", " by Michalis Vasileiadis (closes: #1132575).", " - ssh(1), sshd(8): support IANA-assigned codepoints for SSH agent", " forwarding, as per draft-ietf-sshm-ssh-agent. Support for the new", " names is advertised via the EXT_INFO message. If a server offers", " support for the new names, then they are used preferentially. Support", " for the pre-standardisation \"@openssh.com\" extensions for agent", " forwarding remains supported.", " - ssh-agent(1): implement support for draft-ietf-sshm-ssh-agent \"query\"", " extension.", " - ssh-add(1): support querying the protocol extensions via the agent", " \"query\" extension with a new -Q flag.", " - ssh(1): support multiple files in a ssh_config RevokedHostKeys", " directive.", " - sshd(8): support multiple files in a sshd_config RevokedKeys", " directive.", " - ssh(1): add a ~I escape option that shows information about the", " current SSH connection (closes: #321525).", " - ssh(1): add an \"ssh -Oconninfo user@host\" multiplexing command that", " shows connection information, similar to the ~I escapechar.", " - ssh(1): add an \"ssh -O channels user@host\" multiplexing command to get", " a running mux process to show information about what channels are", " currently open.", " - sshd(8): add 'invaliduser' penalty to PerSourcePenalties, which is", " applied to login attempts for usernames that do not match real", " accounts. Defaults to 5s to match 'authfail' but allows administrators", " to block such attempts for longer if desired.", " - sshd(8): add a GSSAPIDelegateCredentials option for the server,", " controlling whether it accepts delegated credentials offered by the", " client. This option mirrors the same option in ssh_config.", " - ssh(1), sshd(8): support the VA DSCP codepoint in the IPQoS directive.", " - sshd(8): convert PerSourcePenalties to using floating point time,", " allowing penalties to be less than a second. This is useful if you", " need to penalise things you expect to occur at >=1 QPS.", " - ssh-keygen(1): support writing ED25519 keys in PKCS8 format.", " - Support the ed25519 signature scheme via libcrypto.", " - sshd(8): make IPQoS first-match-wins in sshd_config, like other", " configuration directives.", " - sshd(8): fix potential crash when MaxStartups is using a single", " argument (i.e. not using the MaxStartups x:y:z form) to a value below", " 10.", " - sshd(8): fix a potential hang during key exchange if needed DH group", " values were missing from /etc/moduli.", " - ssh-agent(1): fix return values from extensions to be correct wrt", " draft-ietf-sshm-ssh-agent: extension requests should indicate failure", " using SSH_AGENT_EXTENSION_FAILURE rather than the generic", " SSH_AGENT_FAILURE error code. This allows the client to discern", " between \"the request failed\" and \"the agent doesn't support this", " extension\".", " - ssh(1): use fmprintf for showing challenge-response name and info to", " preserve UTF-8 characters where appropriate.", " - scp(1): when uploading a directory using sftp/sftp (e.g. during a", " recursive transfer), don't clobber the remote directory permissions", " unless either we created the directory during the transfer or the -p", " flag was set.", " - All: implement missing pieces of FIDO/webauthn signature support,", " mostly related to certificate handling and enable acceptance of this", " signature format by default.", " - sshd_config(5): make it clear that DenyUsers/DenyGroups overrides", " AllowUsers/AllowGroups. Previously we specified the order in which the", " directives are processed but it was ambiguous as to what happened if", " both matched.", " - ssh(1): don't try to match certificates held in an agent to private", " keys. This matching is done to support certificates that were loaded", " without their private key material, but is unnecessary for", " agent-hosted certificate which always have private key material", " available in the agent. Worse, this matching would mess up the request", " sent to the agent in such a way as to break usage of these keys when", " the key usage was restricted in the agent.", " - sftp(1): if editline has been switched to vi mode (i.e. via \"bind -v\"", " in .editrc), setup a keybinding so that command mode can be entered.", " - ssh(1), sshd(8): improve performance of keying the sntrup761 key", " agreement algorithm.", " - ssh(1), sshd(8): enforce maximum packet/block limit during", " pre-authentication phase.", " - sftp(1): don't misuse the sftp limits extension's open-handles field.", " This value is supposed to be the number of handles a server will allow", " to be opened and not a number of outstanding read/write requests that", " can be sent during an upload/download.", " - sshd(8): don't crash at connection time if the main sshd_config lacks", " any subsystem directive but one is defined in a Match block.", " - sshd_config(5): add a warning next to the ForceCommand directive that", " forcing a command doesn't automatically disable forwarding.", " - sshd_config(5): add a warning that TOKENS are replaced without", " filtering or escaping and that it's the administrator's responsibility", " to ensure they are used safely in context.", " - sshd(8): don't mess up the PerSourceNetBlockSize IPv6 mask if sscanf", " didn't decode it.", " - ssh-add(1): when loading FIDO2 resident keys, set the comment to the", " FIDO application string. This matches the behaviour of ssh-keygen -K.", " - sshd(8): don't strnvis() log messages that are going to be logged by", " sshd-auth via its parent sshd-session process, as the parent will also", " run them though strnvis(). Prevents double-escaping of non-printing", " characters in some log messages.", " - ssh-agent(1): escape SSH_AUTH_SOCK paths that are sent to the shell as", " setenv commands. Unbreaks ssh-agent for home directory paths that", " contain whitespace (closes: #1118288).", " - All: Remove unnecessary checks for ECDSA public key validity.", " - sshd(8): activate UnusedConnectionTimeout only after the last channel", " has closed. Previously UnusedConnectionTimeout could fire early after", " a ChannelTimeout. This was not a problem for the OpenSSH client", " because it terminates once all channels have closed but could cause", " problems for other clients (e.g. API clients) that do things", " differently.", " - scp(1): when using the SFTP protocol for transfers, fix implicit", " destination path selection when source path ends with \"..\".", " - sftp(1): when tab-completing a filename, ensure that the completed", " string does not end up mid-way through a multibyte character, as this", " will cause a fatal() later on.", " - ssh-keygen(1): fix crash at exit (visible via ssh-keygen -D) when", " multiple keys loaded.", " - scp(1)/sftp(1): correctly display bandwidths >2GBps in the progress", " meter.", " - sshd(8): fix condition introduced in openssh 10.2p1 stable branch", " where a PAM module that changed the requested username between", " SSH_MSG_USERAUTH_REQUEST messages during authentication could confuse", " the PAM stack and let it proceed with a different understanding of the", " active username than the rest of sshd. Reported by Mike Damm.", " - sshd(8): immediately report interactive instructions to clients when", " using keyboard-interactive authentication with PAM.", " - sshd(8): fix duplicate PAM messages under some situations.", " - sshd(8): don't leak PAM handle on repeat invocations.", " - sshd(8): fix ut_type for btmp records, correctly using LOGIN_PROCESS", " and USER_PROCESS.", " - sshd(8): allow uname(3) in the seccomp sandbox. This is needed by", " zlib-ng on RISC-V platforms.", " - All: remove remaining OpenSSL_add_all_algorithms() calls. We already", " have OPENSSL_init_crypto() in the compat layer.", "" ], "package": "openssh", "version": "1:10.3p1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 12 Apr 2026 12:49:45 +0100" }, { "cves": [ { "cve": "CVE-2026-3497", "url": "https://ubuntu.com/security/CVE-2026-3497", "cve_description": "Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.", "cve_priority": "medium", "cve_public_date": "2026-03-12 19:16:00 UTC" } ], "log": [ "", " * CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect", " use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly", " initialize some variables (closes: #1130595; thanks, Marc Deslauriers).", " * Do not default to weak GSS-API exchange algorithms (closes: #989906,", " #1131206; LP: #2144812; thanks, Athos Ribeiro).", "" ], "package": "openssh", "version": "1:10.2p1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2144812 ], "author": "Colin Watson ", "date": "Fri, 27 Mar 2026 18:26:06 +0000" }, { "cves": [], "log": [ "", " [ Samuel Thibault ]", " * Do not link against libcrypt on GNU/Hurd (closes: #1128399).", "", " [ Colin Watson ]", " * Install systemd files directly to /usr and drop dh-sequence-movetousr", " (closes: #1122765).", "" ], "package": "openssh", "version": "1:10.2p1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 19 Feb 2026 10:46:15 +0000" }, { "cves": [], "log": [ "", " [ Colin Watson ]", " * Debconf translations:", " - Simplified and Traditional Chinese (thanks, Yangfl; closes: #1124970).", "", " [ Luca Boccassi ]", " * openssh-client: use sysusers.d instead of manual scripting.", " * openssh-client: drop compat postinst not needed since bookworm/noble.", " * openssh-client: drop versioned dependency on i-s-h, satisfied since", " trixie/noble.", " * openssh-client: drop dependency on passwd, add recommends on", " openssh-server.", " * Use dh-sequence-installsysusers and drop d/rules override.", "", " [ Christian Göttsche ]", " * Reorder pam_selinux(7) usage (closes: #747303).", "" ], "package": "openssh", "version": "1:10.2p1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 18 Feb 2026 14:09:13 +0000" }, { "cves": [], "log": [ "", " * Drop \"Rules-Requires-Root: no\", default as of dpkg-dev 1.22.13.", " * Drop openssh-server's dependency on lsb-base.", " * Remove support for direct upgrades from before Debian 12 (bookworm).", " * Rewrite scp-quoting.patch using argv_assemble, and forward it upstream.", "" ], "package": "openssh", "version": "1:10.2p1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 02 Dec 2025 14:36:37 +0000" }, { "cves": [ { "cve": "CVE-2026-35385", "url": "https://ubuntu.com/security/CVE-2026-35385", "cve_description": "In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35386", "url": "https://ubuntu.com/security/CVE-2026-35386", "cve_description": "In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35387", "url": "https://ubuntu.com/security/CVE-2026-35387", "cve_description": "OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35388", "url": "https://ubuntu.com/security/CVE-2026-35388", "cve_description": "OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.", "cve_priority": "medium", "cve_public_date": "2026-04-02 17:16:00 UTC" }, { "cve": "CVE-2026-35414", "url": "https://ubuntu.com/security/CVE-2026-35414", "cve_description": "OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.", "cve_priority": "medium", "cve_public_date": "2026-04-02 18:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: unexpected scp setuid and setgid", " - debian/patches/CVE-2026-35385.patch: clear setuid/setgid bits from", " downloaded files in scp.c.", " - CVE-2026-35385", " * SECURITY UPDATE: command execution via shell metacharacters in username", " - debian/patches/CVE-2026-35386-pre1.patch: apply validity rules on", " ProxyJump usernames and hostnames in readconf.c, readconf.h, ssh.c.", " - debian/patches/CVE-2026-35386.patch: move username check earlier in", " ssh.c.", " - debian/patches/CVE-2026-35386-2.patch: adapt to username validity", " check change in regress/percent.sh.", " - CVE-2026-35386", " * SECURITY UPDATE: use of unintended ECDSA algorithms", " - debian/patches/CVE-2026-35387_35414.patch: correctly match ECDSA", " signature algorithms against algorithm allowlists in", " auth2-hostbased.c, auth2-pubkey.c, sshconnect2.c.", " - CVE-2026-35387", " * SECURITY UPDATE: missing connection multiplexing confirmation", " - debian/patches/CVE-2026-35388.patch: add missing askpass check in", " mux.c.", " - CVE-2026-35388", " * SECURITY UPDATE: authorized_keys principals option mishandling", " - debian/patches/CVE-2026-35387_35414.patch: check for commas in", " auth2-pubkeyfile.c.", " - CVE-2026-35414", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 27 Apr 2026 20:15:40 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3", "version": "3.5.5-1ubuntu3" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu4", "version": "3.5.5-1ubuntu4" }, "cves": [ { "cve": "CVE-2026-34180", "url": "https://ubuntu.com/security/CVE-2026-34180", "cve_description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34181", "url": "https://ubuntu.com/security/CVE-2026-34181", "cve_description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34182", "url": "https://ubuntu.com/security/CVE-2026-34182", "cve_description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34183", "url": "https://ubuntu.com/security/CVE-2026-34183", "cve_description": "Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42764", "url": "https://ubuntu.com/security/CVE-2026-42764", "cve_description": "Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42766", "url": "https://ubuntu.com/security/CVE-2026-42766", "cve_description": "Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42767", "url": "https://ubuntu.com/security/CVE-2026-42767", "cve_description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42768", "url": "https://ubuntu.com/security/CVE-2026-42768", "cve_description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42769", "url": "https://ubuntu.com/security/CVE-2026-42769", "cve_description": "Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42770", "url": "https://ubuntu.com/security/CVE-2026-42770", "cve_description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45445", "url": "https://ubuntu.com/security/CVE-2026-45445", "cve_description": "Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45446", "url": "https://ubuntu.com/security/CVE-2026-45446", "cve_description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45447", "url": "https://ubuntu.com/security/CVE-2026-45447", "cve_description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-7383", "url": "https://ubuntu.com/security/CVE-2026-7383", "cve_description": "Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-9076", "url": "https://ubuntu.com/security/CVE-2026-9076", "cve_description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-34180", "url": "https://ubuntu.com/security/CVE-2026-34180", "cve_description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34181", "url": "https://ubuntu.com/security/CVE-2026-34181", "cve_description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34182", "url": "https://ubuntu.com/security/CVE-2026-34182", "cve_description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34183", "url": "https://ubuntu.com/security/CVE-2026-34183", "cve_description": "Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42764", "url": "https://ubuntu.com/security/CVE-2026-42764", "cve_description": "Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42766", "url": "https://ubuntu.com/security/CVE-2026-42766", "cve_description": "Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42767", "url": "https://ubuntu.com/security/CVE-2026-42767", "cve_description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42768", "url": "https://ubuntu.com/security/CVE-2026-42768", "cve_description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42769", "url": "https://ubuntu.com/security/CVE-2026-42769", "cve_description": "Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42770", "url": "https://ubuntu.com/security/CVE-2026-42770", "cve_description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45445", "url": "https://ubuntu.com/security/CVE-2026-45445", "cve_description": "Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45446", "url": "https://ubuntu.com/security/CVE-2026-45446", "cve_description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45447", "url": "https://ubuntu.com/security/CVE-2026-45447", "cve_description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-7383", "url": "https://ubuntu.com/security/CVE-2026-7383", "cve_description": "Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-9076", "url": "https://ubuntu.com/security/CVE-2026-9076", "cve_description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Heap Buffer Over-read in ASN.1 Content Parsing", " - debian/patches/CVE-2026-34180.patch: Avoid length truncation in", " ASN1_STRING_set in crypto/asn1/tasn_dec.c.", " - CVE-2026-34180", " * SECURITY UPDATE: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys", " - debian/patches/CVE-2026-34181.patch: pkcs12: verify that the pbmac1 key", " length is safe in crypto/pkcs12/p12_mutl.c.", " - CVE-2026-34181", " * SECURITY UPDATE: CMS AuthEnvelopedData Processing May Accept Forged Messages", " - debian/patches/CVE-2026-34182-1.patch: Reject potentially forged encrypted", " CMS AuthEnvelopedData messages in crypto/cms/cms_enc.c.", " - debian/patches/CVE-2026-34182-2.patch: Add tests for CVE-2026-34182 in", " test/cmsapitest.c.", " - CVE-2026-34182", " * SECURITY UPDATE: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", " - debian/patches/CVE-2026-34183-1.patch: QUIC stack must limit the number of", " PATH_CHALLENGE frames processed in RX in include/internal/quic_cfq.h,", " include/internal/quic_channel.h, include/internal/quic_fifd.h,", " ssl/quic/quic_cfq.c, ssl/quic/quic_channel.c,", " ssl/quic/quic_channel_local.h, ssl/quic/quic_fifd.c,", " ssl/quic/quic_rx_depack.c, ssl/quic/quic_txp.c.", " - debian/patches/CVE-2026-34183-2.patch: Add test for path challenge flood", " mitigation in include/internal/quic_channel.h, ssl/quic/quic_channel.c,", " ssl/quic/quic_channel_local.h, ssl/quic/quic_rx_depack.c,", " test/radix/quic_tests.c.", " - CVE-2026-34183", " * SECURITY UPDATE: NULL pointer dereference in QUIC server initial packet", " handling", " - debian/patches/CVE-2026-42764.patch: Fix NULL dereference in QUIC address", " validation in ssl/quic/quic_port.c.", " - CVE-2026-42764", " * SECURITY UPDATE: Possible NULL Dereference in Password-Based CMS Decryption", " - debian/patches/CVE-2026-42766.patch: Fix potential NULL dereference", " processing CMS PasswordRecipientInfo in crypto/cms/cms_pwri.c.", " - CVE-2026-42766", " * SECURITY UPDATE: NULL Pointer Dereference in CRMF EncryptedValue Decryption", " - debian/patches/CVE-2026-42767.patch: Fix potential NULL dereference in", " OSSL_CRMF_ENCRYPTEDVALUE_decrypt() in crypto/crmf/crmf_lib.c.", " - CVE-2026-42767", " * SECURITY UPDATE: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()", " and PKCS7_decrypt()", " - debian/patches/CVE-2026-42768.patch: Enforce implicit rejection for", " CMS/PKCS#7 decryption in crypto/cms/cms_env.c, crypto/pkcs7/pk7_doit.c,", " doc/man3/CMS_decrypt.pod, doc/man3/PKCS7_decrypt.pod.", " - CVE-2026-42768", " * SECURITY UPDATE: Trust-Anchor Substitution via cert/issuer Typo in CMP", " rootCaKeyUpdate", " - debian/patches/CVE-2026-42769.patch: Use the correct issuer when", " validating rootCAKeyUpdate in crypto/cmp/cmp_genm.c.", " - CVE-2026-42769", " * SECURITY UPDATE: FFC-DH Peer Validation Uses Attacker-Supplied q", " - debian/patches/CVE-2026-42770.patch: Match the local q DHX parameter", " against the peer's q in providers/implementations/exchange/dh_exch.c.", " - CVE-2026-42770", " * SECURITY UPDATE: AES-OCB IV Ignored on EVP_Cipher() Path", " - debian/patches/CVE-2026-45445.patch: Apply the buffered IV on the AES-OCB", " EVP_Cipher() path in providers/implementations/ciphers/cipher_aes_ocb.c,", " test/evp_extra_test.c.", " - CVE-2026-45445", " * SECURITY UPDATE: Incorrect Tag Processing for Empty Messages in", " AES-GCM-SIV and AES-SIV modes", " - debian/patches/CVE-2026-45446.patch: Fix handling of empty-ciphertext", " messages in AES-GCM-SIV and AES-SIV in", " providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,", " providers/implementations/ciphers/cipher_aes_siv.c, test/evp_extra_test.c.", " - CVE-2026-45446", " * SECURITY UPDATE: Heap Use-After-Free in OpenSSL PKCS7_verify()", " - debian/patches/CVE-2026-45447-1.patch: Fix possible use-after-free in", " OpenSSL PKCS7_verify() in crypto/pkcs7/pk7_smime.c.", " - debian/patches/CVE-2026-45447-2.patch: Test for CVE-2026-45447 (UAF in", " PKCS7_verify) in test/recipes/80-test_cms.t, test/smime-eml/pkcs7-empty-", " digest-set.eml.", " - CVE-2026-45447", " * SECURITY UPDATE: Possible Heap Buffer Overflow in ASN.1 Multibyte String", " Conversion", " - debian/patches/CVE-2026-7383.patch: Reject oversized inputs in", " ASN1_mbstring_ncopy() in crypto/asn1/a_mbstr.c.", " - CVE-2026-7383", " * SECURITY UPDATE: Out-of-Bounds Read in CMS Password-Based Decryption", " - debian/patches/CVE-2026-9076.patch: cms: kek_unwrap_key: Fix out-of-", " bounds read in check-byte validation in crypto/cms/cms_pwri.c.", " - CVE-2026-9076", " * Fix ppc64 FTBFS because of incorrect regex match (LP: 2137464)", " - debian/patches/regex_match_ecp_nistp521-ppc64.patch: removed,", " incomplete version.", " - debian/patches/fix_ppc64_regex_match.patch: match last filename for", " output in ecp_nistp*-ppc64.pl.", "" ], "package": "openssl", "version": "3.5.5-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 02 Jun 2026 13:21:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl-provider-legacy", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu3", "version": "3.5.5-1ubuntu3" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu4", "version": "3.5.5-1ubuntu4" }, "cves": [ { "cve": "CVE-2026-34180", "url": "https://ubuntu.com/security/CVE-2026-34180", "cve_description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34181", "url": "https://ubuntu.com/security/CVE-2026-34181", "cve_description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34182", "url": "https://ubuntu.com/security/CVE-2026-34182", "cve_description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34183", "url": "https://ubuntu.com/security/CVE-2026-34183", "cve_description": "Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42764", "url": "https://ubuntu.com/security/CVE-2026-42764", "cve_description": "Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42766", "url": "https://ubuntu.com/security/CVE-2026-42766", "cve_description": "Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42767", "url": "https://ubuntu.com/security/CVE-2026-42767", "cve_description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42768", "url": "https://ubuntu.com/security/CVE-2026-42768", "cve_description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42769", "url": "https://ubuntu.com/security/CVE-2026-42769", "cve_description": "Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42770", "url": "https://ubuntu.com/security/CVE-2026-42770", "cve_description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45445", "url": "https://ubuntu.com/security/CVE-2026-45445", "cve_description": "Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45446", "url": "https://ubuntu.com/security/CVE-2026-45446", "cve_description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45447", "url": "https://ubuntu.com/security/CVE-2026-45447", "cve_description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-7383", "url": "https://ubuntu.com/security/CVE-2026-7383", "cve_description": "Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-9076", "url": "https://ubuntu.com/security/CVE-2026-9076", "cve_description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-34180", "url": "https://ubuntu.com/security/CVE-2026-34180", "cve_description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34181", "url": "https://ubuntu.com/security/CVE-2026-34181", "cve_description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34182", "url": "https://ubuntu.com/security/CVE-2026-34182", "cve_description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-34183", "url": "https://ubuntu.com/security/CVE-2026-34183", "cve_description": "Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42764", "url": "https://ubuntu.com/security/CVE-2026-42764", "cve_description": "Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42766", "url": "https://ubuntu.com/security/CVE-2026-42766", "cve_description": "Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42767", "url": "https://ubuntu.com/security/CVE-2026-42767", "cve_description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42768", "url": "https://ubuntu.com/security/CVE-2026-42768", "cve_description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42769", "url": "https://ubuntu.com/security/CVE-2026-42769", "cve_description": "Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-42770", "url": "https://ubuntu.com/security/CVE-2026-42770", "cve_description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45445", "url": "https://ubuntu.com/security/CVE-2026-45445", "cve_description": "Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45446", "url": "https://ubuntu.com/security/CVE-2026-45446", "cve_description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-45447", "url": "https://ubuntu.com/security/CVE-2026-45447", "cve_description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-7383", "url": "https://ubuntu.com/security/CVE-2026-7383", "cve_description": "Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" }, { "cve": "CVE-2026-9076", "url": "https://ubuntu.com/security/CVE-2026-9076", "cve_description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.", "cve_priority": "low", "cve_public_date": "2026-06-09 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Heap Buffer Over-read in ASN.1 Content Parsing", " - debian/patches/CVE-2026-34180.patch: Avoid length truncation in", " ASN1_STRING_set in crypto/asn1/tasn_dec.c.", " - CVE-2026-34180", " * SECURITY UPDATE: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys", " - debian/patches/CVE-2026-34181.patch: pkcs12: verify that the pbmac1 key", " length is safe in crypto/pkcs12/p12_mutl.c.", " - CVE-2026-34181", " * SECURITY UPDATE: CMS AuthEnvelopedData Processing May Accept Forged Messages", " - debian/patches/CVE-2026-34182-1.patch: Reject potentially forged encrypted", " CMS AuthEnvelopedData messages in crypto/cms/cms_enc.c.", " - debian/patches/CVE-2026-34182-2.patch: Add tests for CVE-2026-34182 in", " test/cmsapitest.c.", " - CVE-2026-34182", " * SECURITY UPDATE: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", " - debian/patches/CVE-2026-34183-1.patch: QUIC stack must limit the number of", " PATH_CHALLENGE frames processed in RX in include/internal/quic_cfq.h,", " include/internal/quic_channel.h, include/internal/quic_fifd.h,", " ssl/quic/quic_cfq.c, ssl/quic/quic_channel.c,", " ssl/quic/quic_channel_local.h, ssl/quic/quic_fifd.c,", " ssl/quic/quic_rx_depack.c, ssl/quic/quic_txp.c.", " - debian/patches/CVE-2026-34183-2.patch: Add test for path challenge flood", " mitigation in include/internal/quic_channel.h, ssl/quic/quic_channel.c,", " ssl/quic/quic_channel_local.h, ssl/quic/quic_rx_depack.c,", " test/radix/quic_tests.c.", " - CVE-2026-34183", " * SECURITY UPDATE: NULL pointer dereference in QUIC server initial packet", " handling", " - debian/patches/CVE-2026-42764.patch: Fix NULL dereference in QUIC address", " validation in ssl/quic/quic_port.c.", " - CVE-2026-42764", " * SECURITY UPDATE: Possible NULL Dereference in Password-Based CMS Decryption", " - debian/patches/CVE-2026-42766.patch: Fix potential NULL dereference", " processing CMS PasswordRecipientInfo in crypto/cms/cms_pwri.c.", " - CVE-2026-42766", " * SECURITY UPDATE: NULL Pointer Dereference in CRMF EncryptedValue Decryption", " - debian/patches/CVE-2026-42767.patch: Fix potential NULL dereference in", " OSSL_CRMF_ENCRYPTEDVALUE_decrypt() in crypto/crmf/crmf_lib.c.", " - CVE-2026-42767", " * SECURITY UPDATE: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()", " and PKCS7_decrypt()", " - debian/patches/CVE-2026-42768.patch: Enforce implicit rejection for", " CMS/PKCS#7 decryption in crypto/cms/cms_env.c, crypto/pkcs7/pk7_doit.c,", " doc/man3/CMS_decrypt.pod, doc/man3/PKCS7_decrypt.pod.", " - CVE-2026-42768", " * SECURITY UPDATE: Trust-Anchor Substitution via cert/issuer Typo in CMP", " rootCaKeyUpdate", " - debian/patches/CVE-2026-42769.patch: Use the correct issuer when", " validating rootCAKeyUpdate in crypto/cmp/cmp_genm.c.", " - CVE-2026-42769", " * SECURITY UPDATE: FFC-DH Peer Validation Uses Attacker-Supplied q", " - debian/patches/CVE-2026-42770.patch: Match the local q DHX parameter", " against the peer's q in providers/implementations/exchange/dh_exch.c.", " - CVE-2026-42770", " * SECURITY UPDATE: AES-OCB IV Ignored on EVP_Cipher() Path", " - debian/patches/CVE-2026-45445.patch: Apply the buffered IV on the AES-OCB", " EVP_Cipher() path in providers/implementations/ciphers/cipher_aes_ocb.c,", " test/evp_extra_test.c.", " - CVE-2026-45445", " * SECURITY UPDATE: Incorrect Tag Processing for Empty Messages in", " AES-GCM-SIV and AES-SIV modes", " - debian/patches/CVE-2026-45446.patch: Fix handling of empty-ciphertext", " messages in AES-GCM-SIV and AES-SIV in", " providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,", " providers/implementations/ciphers/cipher_aes_siv.c, test/evp_extra_test.c.", " - CVE-2026-45446", " * SECURITY UPDATE: Heap Use-After-Free in OpenSSL PKCS7_verify()", " - debian/patches/CVE-2026-45447-1.patch: Fix possible use-after-free in", " OpenSSL PKCS7_verify() in crypto/pkcs7/pk7_smime.c.", " - debian/patches/CVE-2026-45447-2.patch: Test for CVE-2026-45447 (UAF in", " PKCS7_verify) in test/recipes/80-test_cms.t, test/smime-eml/pkcs7-empty-", " digest-set.eml.", " - CVE-2026-45447", " * SECURITY UPDATE: Possible Heap Buffer Overflow in ASN.1 Multibyte String", " Conversion", " - debian/patches/CVE-2026-7383.patch: Reject oversized inputs in", " ASN1_mbstring_ncopy() in crypto/asn1/a_mbstr.c.", " - CVE-2026-7383", " * SECURITY UPDATE: Out-of-Bounds Read in CMS Password-Based Decryption", " - debian/patches/CVE-2026-9076.patch: cms: kek_unwrap_key: Fix out-of-", " bounds read in check-byte validation in crypto/cms/cms_pwri.c.", " - CVE-2026-9076", " * Fix ppc64 FTBFS because of incorrect regex match (LP: 2137464)", " - debian/patches/regex_match_ecp_nistp521-ppc64.patch: removed,", " incomplete version.", " - debian/patches/fix_ppc64_regex_match.patch: match last filename for", " output in ecp_nistp*-ppc64.pl.", "" ], "package": "openssl", "version": "3.5.5-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 02 Jun 2026 13:21:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "packagekit", "from_version": { "source_package_name": "packagekit", "source_package_version": "1.3.6-1", "version": "1.3.6-1" }, "to_version": { "source_package_name": "packagekit", "source_package_version": "1.3.6-1ubuntu1", "version": "1.3.6-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148469 ], "changes": [ { "cves": [], "log": [ "", " [ Hector Cao ]", " * d/p/lp2148469-apt-use-solve-3.0.patch: use apt solver 3.0", " (LP: #2148469)", "", " [ Alessandro Astone ]", " * d/p/pkgcli-Skip-blocked-updates-in-full-upgrade-too.patch.", " Fix `pkgcli upgrade` command after switching to apt solver 3.0, which would", " fail if some update was held back.", "" ], "package": "packagekit", "version": "1.3.6-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148469 ], "author": "Alessandro Astone ", "date": "Mon, 20 Jul 2026 13:08:28 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8", "version": "5.40.1-8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8ubuntu1", "version": "5.40.1-8ubuntu1" }, "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: directory traversal vulnerability", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " linkname in Archive::Tar secure extract mode to prevent extraction", " outside the target directory", " - CVE-2026-42496", "" ], "package": "perl", "version": "5.40.1-8ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Thu, 02 Jul 2026 13:14:46 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8", "version": "5.40.1-8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8ubuntu1", "version": "5.40.1-8ubuntu1" }, "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: directory traversal vulnerability", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " linkname in Archive::Tar secure extract mode to prevent extraction", " outside the target directory", " - CVE-2026-42496", "" ], "package": "perl", "version": "5.40.1-8ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Thu, 02 Jul 2026 13:14:46 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-modules-5.40", "from_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8", "version": "5.40.1-8" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.40.1-8ubuntu1", "version": "5.40.1-8ubuntu1" }, "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42496", "url": "https://ubuntu.com/security/CVE-2026-42496", "cve_description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: directory traversal vulnerability", " - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink", " linkname in Archive::Tar secure extract mode to prevent extraction", " outside the target directory", " - CVE-2026-42496", "" ], "package": "perl", "version": "5.40.1-8ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Thu, 02 Jul 2026 13:14:46 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "powermgmt-base", "from_version": { "source_package_name": "powermgmt-base", "source_package_version": "1.38ubuntu2", "version": "1.38ubuntu2" }, "to_version": { "source_package_name": "powermgmt-base", "source_package_version": "1.39ubuntu1", "version": "1.39ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2161446 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2161446). Remaining changes:", " - on_ac_power: improve reporting of AC power status in more scenarios", " (LP #1980991)", "" ], "package": "powermgmt-base", "version": "1.39ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2161446 ], "author": "Varun Varma ", "date": "Tue, 21 Jul 2026 12:45:41 -0400" }, { "cves": [], "log": [ "", " * Team upload, salsa.d.o debian namespace", "", " [ наб ]", " * lspower: correctly silence errors & clear on ENOENT (Closes: #1119875)", "" ], "package": "powermgmt-base", "version": "1.39", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 21 Jun 2026 10:53:09 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "publicsuffix", "from_version": { "source_package_name": "publicsuffix", "source_package_version": "20260428.1050-1", "version": "20260428.1050-1" }, "to_version": { "source_package_name": "publicsuffix", "source_package_version": "20260624.0617-1", "version": "20260624.0617-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * new upstream version", "" ], "package": "publicsuffix", "version": "20260624.0617-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Florian Ernst ", "date": "Fri, 26 Jun 2026 15:46:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-apport", "from_version": { "source_package_name": "apport", "source_package_version": "2.34.0-0ubuntu2", "version": "2.34.0-0ubuntu2" }, "to_version": { "source_package_name": "apport", "source_package_version": "2.35.0-0ubuntu1", "version": "2.35.0-0ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", " - Fix support for zstd compressed CoreDump (LP: #2148656)", " - apt_dpkg:", " + support using configured proxies (LP: #2116119)", " + exclude {usr/,}lib/modules and more from Contents-*.gz cache", " to reduce required memory for apport-retrace (LP: #2073787)", " + fix mapping primary ports.ubuntu.com to archive.ubuntu.com", " (LP: #2150427)", " + fix GDB command for amd64 sandbox on non-amd64 (LP: #2150427)", " - problem_report:", " + enforce some keys to always have str values in load() (LP: #2146806)", " + avoid double .txt file extension (LP: #2149892)", " - test:", " + use pwd, ls, and true from GNU coreutils in apport-valgrind tests", " (LP: #2158973)", " + relax check for Package field (LP: #2149909)", " + fix running tests as non-root system user (LP: #2153134)", " * test: replace SKIP_ONLINE_TESTS by requires_internet marker", "" ], "package": "apport", "version": "2.35.0-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "author": "Benjamin Drung ", "date": "Thu, 02 Jul 2026 21:51:47 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-certifi", "from_version": { "source_package_name": "python-certifi", "source_package_version": "2026.5.20+ds-1", "version": "2026.5.20+ds-1" }, "to_version": { "source_package_name": "python-certifi", "source_package_version": "2026.6.17+ds-1", "version": "2026.6.17+ds-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", "" ], "package": "python-certifi", "version": "2026.6.17+ds-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 23 Jun 2026 11:35:04 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-debian", "from_version": { "source_package_name": "python-debian", "source_package_version": "1.1.0ubuntu1", "version": "1.1.0ubuntu1" }, "to_version": { "source_package_name": "python-debian", "source_package_version": "1.1.1", "version": "1.1.1" }, "cves": [], "launchpad_bugs_fixed": [ 2132257, 1977475 ], "changes": [ { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Drop python3-charset-normalizer from Depends/Recommends,", " to avoid component-mismatch", "" ], "package": "python-debian", "version": "1.1.0ubuntu1", "urgency": "low", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Tue, 05 May 2026 23:01:03 +0200" }, { "cves": [], "log": [ "", " * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)", "" ], "package": "python-debian", "version": "1.0.1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2132257 ], "author": "Sebastien Bacher ", "date": "Sat, 06 Dec 2025 11:52:25 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Drop python3-charset-normalizer from Depends/Recommends,", " to avoid component-mismatch", "" ], "package": "python-debian", "version": "1.0.1ubuntu1", "urgency": "medium", "distributions": "plucky", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Wed, 12 Mar 2025 08:25:59 +0100" }, { "cves": [], "log": [ "", " * d/control: Drop python3-charset-normalizer from Depends/Recommends,", " to avoid component-mismatch, see Salsa MR!140 (LP: #1977475)", "" ], "package": "python-debian", "version": "1.0.0ubuntu2", "urgency": "medium", "distributions": "plucky", "launchpad_bugs_fixed": [ 1977475 ], "author": "Lukas Märdian ", "date": "Tue, 11 Mar 2025 09:31:20 +0100" }, { "cves": [], "log": [ "", " * Fix component mismatch.", "" ], "package": "python-debian", "version": "1.0.0ubuntu1", "urgency": "medium", "distributions": "plucky", "launchpad_bugs_fixed": [], "author": "Simon Quigley ", "date": "Mon, 10 Mar 2025 07:30:30 -0500" } ], "notes": null, "is_version_downgrade": true }, { "name": "python3-distro", "from_version": { "source_package_name": "python-distro", "source_package_version": "1.9.0-1build1", "version": "1.9.0-1build1" }, "to_version": { "source_package_name": "python-distro", "source_package_version": "1.9.0-2", "version": "1.9.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload", " * Rewrite d/watch in v5 format", " * Drop \"Rules-Requires-Root: no\": it is the default now", " * Bump Standards-Version to 4.7.4, drop Priority: tag", " * Drop duplicate dh-python", " * Mark python3-pytest as ", " * Salsa CI: test nocheck profile", "" ], "package": "python-distro", "version": "1.9.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Sat, 04 Jul 2026 22:43:47 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-hamcrest", "from_version": { "source_package_name": "pyhamcrest", "source_package_version": "2.1.0-3", "version": "2.1.0-3" }, "to_version": { "source_package_name": "pyhamcrest", "source_package_version": "2.1.0-4", "version": "2.1.0-4" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * Test build profile with Salsa CI", " * Update standards version to 4.7.4, no changes needed.", " * Set upstream metadata fields: Repository.", "" ], "package": "pyhamcrest", "version": "2.1.0-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Thu, 25 Jun 2026 23:03:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-httplib2", "from_version": { "source_package_name": "python-httplib2", "source_package_version": "0.22.0-1build1", "version": "0.22.0-1build1" }, "to_version": { "source_package_name": "python-httplib2", "source_package_version": "0.31.2-2", "version": "0.31.2-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * Drop build-dep on python3-six", " * Drop \"Rules-Requires-Root: no\": it is the default now", " * Bump Standards-Version to 4.7.4, no change needed", " * Add debian/salsa-ci.yml", "" ], "package": "python-httplib2", "version": "0.31.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Wed, 15 Apr 2026 12:24:26 +0200" }, { "cves": [], "log": [ "", " * Team upload.", " * New upstream version 0.31.2", " * d/copyright: Fix paths, remove unneeded license", " * d/control: Add max version restriction for pyparsing", " * Refresh patches.", " * d/control: add new dep on python3-socks needed for testing", " * Bump S-V; drop Priority field", " * Upgrade d/watch to v5", "" ], "package": "python-httplib2", "version": "0.31.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Harlan Lieberman-Berg ", "date": "Wed, 11 Mar 2026 21:54:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jmespath", "from_version": { "source_package_name": "python-jmespath", "source_package_version": "1.0.1-1build1", "version": "1.0.1-1build1" }, "to_version": { "source_package_name": "python-jmespath", "source_package_version": "1.0.1-2", "version": "1.0.1-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team Upload", " * Salsa CI: test nocheck profile", " * Use dh-sequence-python3", " * Bump Standards-Version to 4.7.4, drop Priority: tag", " * Rewrite d/watch in v5 format", " * Annotate python3-pytest as ", "" ], "package": "python-jmespath", "version": "1.0.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Sun, 05 Jul 2026 17:18:20 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jsonschema-specifications", "from_version": { "source_package_name": "python-jsonschema-specifications", "source_package_version": "2023.12.1-5", "version": "2023.12.1-5" }, "to_version": { "source_package_name": "python-jsonschema-specifications", "source_package_version": "2023.12.1-6", "version": "2023.12.1-6" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Removed python3-poetry-core from build-depends (Closes: #1141528).", " * Removed python3-setuptools{,-scm} from build-depends (Closes: #1141527).", "" ], "package": "python-jsonschema-specifications", "version": "2023.12.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Thomas Goirand ", "date": "Tue, 07 Jul 2026 14:20:10 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-oauthlib", "from_version": { "source_package_name": "python-oauthlib", "source_package_version": "3.3.1-1build1", "version": "3.3.1-1build1" }, "to_version": { "source_package_name": "python-oauthlib", "source_package_version": "3.3.1-2", "version": "3.3.1-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * Drop \"Rules-Requires-Root: no\": it is the default now", " * Bump Standards-Version to 4.7.4, drop Priority: tag", " * Rewrite d/watch in v5 format", " * d/rules: syntax glitch", " * Salsa CI: test nocheck profile", " * Mark test dependencies as : python3-pytest,", " python3-blinker, python3-cryptography python3-jwt", "" ], "package": "python-oauthlib", "version": "3.3.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Sun, 05 Jul 2026 18:18:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-problem-report", "from_version": { "source_package_name": "apport", "source_package_version": "2.34.0-0ubuntu2", "version": "2.34.0-0ubuntu2" }, "to_version": { "source_package_name": "apport", "source_package_version": "2.35.0-0ubuntu1", "version": "2.35.0-0ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", " - Fix support for zstd compressed CoreDump (LP: #2148656)", " - apt_dpkg:", " + support using configured proxies (LP: #2116119)", " + exclude {usr/,}lib/modules and more from Contents-*.gz cache", " to reduce required memory for apport-retrace (LP: #2073787)", " + fix mapping primary ports.ubuntu.com to archive.ubuntu.com", " (LP: #2150427)", " + fix GDB command for amd64 sandbox on non-amd64 (LP: #2150427)", " - problem_report:", " + enforce some keys to always have str values in load() (LP: #2146806)", " + avoid double .txt file extension (LP: #2149892)", " - test:", " + use pwd, ls, and true from GNU coreutils in apport-valgrind tests", " (LP: #2158973)", " + relax check for Package field (LP: #2149909)", " + fix running tests as non-root system user (LP: #2153134)", " * test: replace SKIP_ONLINE_TESTS by requires_internet marker", "" ], "package": "apport", "version": "2.35.0-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148656, 2116119, 2073787, 2150427, 2150427, 2146806, 2149892, 2158973, 2149909, 2153134 ], "author": "Benjamin Drung ", "date": "Thu, 02 Jul 2026 21:51:47 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-service-identity", "from_version": { "source_package_name": "python-service-identity", "source_package_version": "24.2.0-1build1", "version": "24.2.0-1build1" }, "to_version": { "source_package_name": "python-service-identity", "source_package_version": "24.2.0-2", "version": "24.2.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * Remove redundant Priority: optional from source stanza.", " * Remove redundant relation in debian/control.", " * Add debian/upstream/metadata", " * Add debian/salsa-ci.yml", " * Rewrite d/watch in v5 format", " * Mark some build-deps as ", " * Bump Standards-Version to 4.7.4", "" ], "package": "python-service-identity", "version": "24.2.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Fri, 26 Jun 2026 00:03:16 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-typeguard", "from_version": { "source_package_name": "python-typeguard", "source_package_version": "4.4.4-2", "version": "4.4.4-2" }, "to_version": { "source_package_name": "python-typeguard", "source_package_version": "4.4.4-3", "version": "4.4.4-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * Add debian/salsa-ci.yml to test the profile", " * Rename debian/{docs,python3-typeguard.docs} for future dh 14 compatibility", " * Bump Standards-Version to 4.7.4, drop Priority: tag", " * Rewrite d/watch in v5 format", " * Mark test dependencies as ", "" ], "package": "python-typeguard", "version": "4.4.4-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Mon, 29 Jun 2026 11:26:04 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-update-manager", "from_version": { "source_package_name": "update-manager", "source_package_version": "1:26.04.5", "version": "1:26.04.5" }, "to_version": { "source_package_name": "update-manager", "source_package_version": "1:26.10.1", "version": "1:26.10.1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Nathan Pratta Teodosio ]", " * Switch from RequestReboot to Reboot", " * Turn inhbit_sleep into a no-op.", " * Fix normal updates being shadowed by unavailable Pro counterparts.", " * Remove prompt to enable Pro if already attached.", " * Fix linter warnings.", "", " [ Alessandro Astone ]", " * Re-introduce accidentally dropped import statement", " * Drop duplicate import statement", "" ], "package": "update-manager", "version": "1:26.10.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Wed, 01 Jul 2026 16:52:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-urllib3", "from_version": { "source_package_name": "python-urllib3", "source_package_version": "2.6.3-1ubuntu1", "version": "2.6.3-1ubuntu1" }, "to_version": { "source_package_name": "python-urllib3", "source_package_version": "2.6.3-2ubuntu1", "version": "2.6.3-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-44431", "url": "https://ubuntu.com/security/CVE-2026-44431", "cve_description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "cve_priority": "medium", "cve_public_date": "2026-05-13 16:16:00 UTC" }, { "cve": "CVE-2026-44432", "url": "https://ubuntu.com/security/CVE-2026-44432", "cve_description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.", "cve_priority": "medium", "cve_public_date": "2026-05-13 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-44431", "url": "https://ubuntu.com/security/CVE-2026-44431", "cve_description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "cve_priority": "medium", "cve_public_date": "2026-05-13 16:16:00 UTC" }, { "cve": "CVE-2026-44432", "url": "https://ubuntu.com/security/CVE-2026-44432", "cve_description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.", "cve_priority": "medium", "cve_public_date": "2026-05-13 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sensitive headers not stripped in cross-origin redirects", " - debian/patches/CVE-2026-44431.patch: remove sensitive headers in proxy", " pools too in dummyserver/asgi_proxy.py, src/urllib3/connectionpool.py,", " test/with_dummyserver/test_proxy_poolmanager.py.", " - CVE-2026-44431", " * SECURITY UPDATE: resource consumption via response decompression", " - debian/patches/CVE-2026-44432.patch: fix full decompression on the 2nd", " small read from response using Brotli in", " src/urllib3/response.py, test/test_response.py,", " test/with_dummyserver/test_connection.py.", " - CVE-2026-44432", "" ], "package": "python-urllib3", "version": "2.6.3-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 03 Jun 2026 13:14:19 -0400" }, { "cves": [], "log": [ "", " * Team upload.", " * Add python3-supported-min alternative for backports.zstd (see #1130913).", "" ], "package": "python-urllib3", "version": "2.6.3-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 18 Mar 2026 12:38:29 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-wadllib", "from_version": { "source_package_name": "python-wadllib", "source_package_version": "2.0.0-3", "version": "2.0.0-3" }, "to_version": { "source_package_name": "python-wadllib", "source_package_version": "2.1.0-1", "version": "2.1.0-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", "" ], "package": "python-wadllib", "version": "2.1.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Stefano Rivera ", "date": "Sat, 04 Jul 2026 15:38:15 -0400" }, { "cves": [], "log": [ "", " * Team upload.", " * Add debian/salsa-ci.yml", " * Mark test dependencies as ", " * Set Debian Python Team as Maintainer per new team policy", " * Use dh-sequence-python3", " * Drop \"Rules-Requires-Root: no\": it is the default now", " * Bump Standards-Version to 4.7.4, drop Priority: tag", " * Rewrite d/watch in v5 format", " * Set upstream metadata fields: Contact, Documentation, Security-Contact.", "" ], "package": "python-wadllib", "version": "2.0.0-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Sun, 28 Jun 2026 21:24:17 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-zope.interface", "from_version": { "source_package_name": "zope.interface", "source_package_version": "8.5-1", "version": "8.5-1" }, "to_version": { "source_package_name": "zope.interface", "source_package_version": "8.5-2", "version": "8.5-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team Upload", " * Salsa CI: test !nocheck & !nodoc profiles", " * Mark python3-pytest & python3-zope.testing as ", " * Set upstream metadata fields: Documentation.", "" ], "package": "zope.interface", "version": "8.5-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Wed, 24 Jun 2026 12:33:36 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "rsyslog", "from_version": { "source_package_name": "rsyslog", "source_package_version": "8.2512.0-1ubuntu4", "version": "8.2512.0-1ubuntu4" }, "to_version": { "source_package_name": "rsyslog", "source_package_version": "8.2512.0-1ubuntu5", "version": "8.2512.0-1ubuntu5" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * No-change rebuild for net-snmp 5.9.5", "" ], "package": "rsyslog", "version": "8.2512.0-1ubuntu5", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Hector Cao ", "date": "Mon, 08 Jun 2026 09:21:14 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.76+ubuntu26.10.2", "version": "2.76+ubuntu26.10.2" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu26.10", "version": "2.76.3+ubuntu26.10" }, "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" }, { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-8933", "url": "https://ubuntu.com/security/CVE-2026-8933", "cve_description": "A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-15226", "url": "https://ubuntu.com/security/CVE-2026-15226", "cve_description": "A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" } ], "launchpad_bugs_fixed": [ 2158301, 2159940, 2157692, 2067006 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2158301", " - FDE: support keyboard configuration at install-time for first-boot", " - FDE: re-enable passphrases/PINs at install-time", " - FDE: require volumes authentication if HWROT is missing", " - FDE: bump secboot to rev 457b03a16d19", " - FDE: use new secboot API for reprovision TPM", " - Cross-distro: modify SELinux policy to use", " init_named_socket_activation() for allowing systemd to start snapd", " through socket activation", " - packaging: make sure that usr/bin/snap is built with correct build", " tags on debian sid", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", "" ], "package": "snapd", "version": "2.76.3+ubuntu26.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158301 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 10:06:48 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2159940", " - interfaces: steam-support, docker-support | fix mountinfo denial", "" ], "package": "snapd", "version": "2.76.2+ubuntu26.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2159940 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 08:38:51 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", "" ], "package": "snapd", "version": "2.76.1+ubuntu26.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Thu, 25 Jun 2026 13:09:05 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-8933", "url": "https://ubuntu.com/security/CVE-2026-8933", "cve_description": "A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" }, { "cve": "CVE-2026-15226", "url": "https://ubuntu.com/security/CVE-2026-15226", "cve_description": "A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.", "cve_priority": "high", "cve_public_date": "2026-07-21 14:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: information disclosure", " - interfaces/apparmor/template.go: don't grant access to systemd", " userdb API sockets.", " - CVE-2024-5300", " * SECURITY UPDATE: Privilege escalation", " - cmd/snap-confine: harden construction of bootstrap rootfs", " - CVE-2026-8933", " * SECURITY UPDATE: Privilege abuse", " - interfaces/snap-confine: harden seccomp template", " - CVE-2026-15226", "" ], "package": "snapd", "version": "2.76+ubuntu26.10.3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Thu, 09 Jul 2026 12:32:41 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "sysvinit-utils", "from_version": { "source_package_name": "sysvinit", "source_package_version": "3.15-5ubuntu1", "version": "3.15-5ubuntu1" }, "to_version": { "source_package_name": "sysvinit", "source_package_version": "3.18-1ubuntu1", "version": "3.18-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2153360 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153360). Remaining changes:", " - d/rules: when building for Ubuntu, skip all binaries", " except for sysvinit-utils.", " - d/rules: install sysvinit-utils into /usr.", "" ], "package": "sysvinit", "version": "3.18-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153360 ], "author": "Carter Hawthorne ", "date": "Thu, 02 Jul 2026 15:09:29 -0700" }, { "cves": [], "log": [ "", " * New upstream version 3.18. Includes:-", " - inittab.5 updates (Closes: #1095701)", " - reduce verbosity of inittab.d support (Closes: #1131137)", " * d/control:", " - update libselinux Build-Depends (lintian).", " - bump Standards Version (drop Priority: optional, now it is the", " default).", " -drop 'R³: no' now it is the default.", " * Refresh patches.", " * d/copyright: remove sysd2v stanza, dropped upstream.", "" ], "package": "sysvinit", "version": "3.18-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Hindley ", "date": "Tue, 31 Mar 2026 13:26:42 +0100" }, { "cves": [], "log": [ "", " [ Mark Hindley ]", " * d/initscripts.maintscript: remove time-served motd conffile handling.", " * init-d-script: move test for setpriv availability to top level.", " (Closes: #1119154)", "", " [ Edgar Yllescas ]", " * Add support for AMD backlight (Closes: #1120309).", "" ], "package": "sysvinit", "version": "3.15-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Hindley ", "date": "Sun, 16 Nov 2025 08:46:32 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "trace-cmd", "from_version": { "source_package_name": "trace-cmd", "source_package_version": "3.3.3-1ubuntu2", "version": "3.3.3-1ubuntu2" }, "to_version": { "source_package_name": "trace-cmd", "source_package_version": "3.4-1", "version": "3.4-1" }, "cves": [], "launchpad_bugs_fixed": [ 2130149, 2114514, 2112078, 2060545, 2051850 ], "changes": [ { "cves": [], "log": [ "", " * No-change rebuild with Python 3.14 as default", "" ], "package": "trace-cmd", "version": "3.3.3-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Graham Inggs ", "date": "Thu, 22 Jan 2026 22:04:08 +0000" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2130149). Remaining changes:", " - trace-utest: return non-zero when tests have failed", " - trace-utest: run trace-cmd with --compression none on s390x", " (LP 2114514)", " * Dropped changes, included in Debian:", " - debian/patches: fallback to using /usr/bin/trace-cmd in trace-utest", " - debian/tests: add trace-utest and trace-cmd-examples dep8 tests", "" ], "package": "trace-cmd", "version": "3.3.3-1ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2130149 ], "author": "Nick Rosbrook ", "date": "Wed, 03 Dec 2025 10:09:48 -0500" }, { "cves": [], "log": [ "", " * trace-utest: run trace-cmd with --compression none on s390x", " (LP: #2114514)", " * trace-utest: return non-zero when tests have failed", "" ], "package": "trace-cmd", "version": "3.3.1-1ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2114514 ], "author": "Nick Rosbrook ", "date": "Mon, 23 Jun 2025 15:45:56 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2112078). Remaining changes:", " - debian/patches: fallback to using /usr/bin/trace-cmd in trace-utest", " - debian/tests: add trace-utest and trace-cmd-examples dep8 tests", " * Dropped, fixed upstream:", " - debian/patches/0003-include-missing-libgen-header.patch", "" ], "package": "trace-cmd", "version": "3.3.1-1ubuntu1", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2112078 ], "author": "Nick Rosbrook ", "date": "Thu, 05 Jun 2025 13:26:02 -0400" }, { "cves": [], "log": [ "", " * debian/tests: use consistent skipping conditions for autopkgtest", " (LP: #2060545)", "" ], "package": "trace-cmd", "version": "3.2-1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2060545 ], "author": "Nick Rosbrook ", "date": "Mon, 08 Apr 2024 12:13:38 -0400" }, { "cves": [], "log": [ "", " * Address autopkgtest TODOs for MIR (LP: #2051850)", " - debian/tests: add simple autopkgtest using man page examples", " - debian/tests/control: run trace-utest as autopkgtest", " - debian/patches: fallback to using /usr/bin/trace-cmd in trace-utest", "" ], "package": "trace-cmd", "version": "3.2-1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2051850 ], "author": "Nick Rosbrook ", "date": "Fri, 05 Apr 2024 16:36:49 -0400" } ], "notes": null, "is_version_downgrade": true }, { "name": "tzdata", "from_version": { "source_package_name": "tzdata", "source_package_version": "2026b-1ubuntu1", "version": "2026b-1ubuntu1" }, "to_version": { "source_package_name": "tzdata", "source_package_version": "2026b-1ubuntu2", "version": "2026b-1ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2157973 ], "changes": [ { "cves": [], "log": [ "", " * Update the ICU timezone data to 2026b (LP: #2157973)", " * Add autopkgtest test case for ICU timezone data 2026b", "" ], "package": "tzdata", "version": "2026b-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157973 ], "author": "Benjamin Drung ", "date": "Tue, 23 Jun 2026 13:42:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-kernel-accessories", "from_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.572", "version": "1.572" }, "to_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.573", "version": "1.573" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Refreshed dependencies", " * Added dbus-broker to cloud-minimal, server-minimal", " * Removed dbus from cloud-minimal, server-minimal", " * Removed memtest86+ from desktop-minimal-recommends [amd64 amd64v3],", " desktop-raspi-recommends [amd64 amd64v3], desktop-recommends [amd64", " amd64v3]", "" ], "package": "ubuntu-meta", "version": "1.573", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Thu, 23 Jul 2026 17:21:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-minimal", "from_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.572", "version": "1.572" }, "to_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.573", "version": "1.573" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Refreshed dependencies", " * Added dbus-broker to cloud-minimal, server-minimal", " * Removed dbus from cloud-minimal, server-minimal", " * Removed memtest86+ from desktop-minimal-recommends [amd64 amd64v3],", " desktop-raspi-recommends [amd64 amd64v3], desktop-recommends [amd64", " amd64v3]", "" ], "package": "ubuntu-meta", "version": "1.573", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Thu, 23 Jul 2026 17:21:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-server", "from_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.572", "version": "1.572" }, "to_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.573", "version": "1.573" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Refreshed dependencies", " * Added dbus-broker to cloud-minimal, server-minimal", " * Removed dbus from cloud-minimal, server-minimal", " * Removed memtest86+ from desktop-minimal-recommends [amd64 amd64v3],", " desktop-raspi-recommends [amd64 amd64v3], desktop-recommends [amd64", " amd64v3]", "" ], "package": "ubuntu-meta", "version": "1.573", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Thu, 23 Jul 2026 17:21:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-standard", "from_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.572", "version": "1.572" }, "to_version": { "source_package_name": "ubuntu-meta", "source_package_version": "1.573", "version": "1.573" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Refreshed dependencies", " * Added dbus-broker to cloud-minimal, server-minimal", " * Removed dbus from cloud-minimal, server-minimal", " * Removed memtest86+ from desktop-minimal-recommends [amd64 amd64v3],", " desktop-raspi-recommends [amd64 amd64v3], desktop-recommends [amd64", " amd64v3]", "" ], "package": "ubuntu-meta", "version": "1.573", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Thu, 23 Jul 2026 17:21:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ucf", "from_version": { "source_package_name": "ucf", "source_package_version": "3.0052ubuntu1", "version": "3.0052ubuntu1" }, "to_version": { "source_package_name": "ucf", "source_package_version": "3.0056", "version": "3.0056" }, "cves": [], "launchpad_bugs_fixed": [ 2142754 ], "changes": [ { "cves": [], "log": [ "", " * Upload to unstable", "" ], "package": "ucf", "version": "3.0056", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Hindley ", "date": "Thu, 25 Jun 2026 08:28:05 +0100" }, { "cves": [], "log": [ "", " * Add missing test and autopkgtest dependency on bsdextrautils for", " rev(1).", " * Drop unnecessary autopkgtest dependency on diffutils (Priority:", " Required).", "" ], "package": "ucf", "version": "3.0055", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Mark Hindley ", "date": "Thu, 18 Jun 2026 19:00:48 +0100" }, { "cves": [], "log": [ "", " [ Mark Hindley ]", " * ucf,ucfr: preserve COWDANCER_* environment variables.", " * d/control: bump Standards Version (no changes).", " * ucf_library.sh: add warn() to print to stderr.", " * ufc:", " - use warn() for --no-action output to avoid interaction with debconf.", " - do not load debconf module at all under --no-action.", " * ucfr:", " - don't choke on missing registry when called with --no-action.", " * t/:", " - fix testsuite: git ignores empty directories, so create expected", " subdirs if necessary.", " - basic_noaction: convert output to reproducible relative paths.", " - record the exit status in the expected test output", " - distinguish testsuite reports.", " * t/run:", " - also capture and diff stderr.", " * t/run_rootless: don't rely on ucf being installed.", " * ucf_helper_functions.sh: add DPKG_ROOT support.", " * man/ucf_helper_functions.sh.5: escape fullstop at beginning of line.", " * Add shellcheck directives to find dynamically sourced files.", " * Makefile: add ucf_helper_functions.sh to check and shellcheck recipes.", " * d/tests: add t/run_rootless as autopkgtest.", "", " [ Johannes Schauer Marin Rodrigues ]", " * ucf,ucfr: keep LD_LIBRARY_PATH and LD_PRELOAD", " * Support $DPKG_ROOT in ucf and ucfr utilities", " * ucfq: add support for --root and $DPKG_ROOT", " * add tests for DPKG_ROOT", "", " [ Nick Rosbrook ]", " * Makefile: quote version string during replacement (LP: #2142754)", "", " [ Marc Haber ]", " * add ucf_helper_functions.sh and man page (Closes: #1138790)", " * t/run: bind-mount /dev/null so that cp -p succeeds in unshare.", "" ], "package": "ucf", "version": "3.0054", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [ 2142754 ], "author": "Mark Hindley ", "date": "Wed, 17 Jun 2026 15:08:03 +0100" }, { "cves": [], "log": [ "", " [ Mark Hindley ]", " * d/copyright: remove old FSF address (lintian).", " * d/control: bump Standards Version (no changes).", " * d/control: drop 'R³: no' now it is the default.", "", " [ Johannes Schauer Marin Rodrigues ]", " * Support $DPKG_ROOT in maintainer scripts (Closes: #1130328).", "" ], "package": "ucf", "version": "3.0053", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Hindley ", "date": "Wed, 11 Mar 2026 12:13:35 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "udisks2", "from_version": { "source_package_name": "udisks2", "source_package_version": "2.10.91-1ubuntu2", "version": "2.10.91-1ubuntu2" }, "to_version": { "source_package_name": "udisks2", "source_package_version": "2.11.1-2ubuntu1", "version": "2.11.1-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2153367 ], "changes": [ { "cves": [ { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" } ], "log": [ "", " * Merge from Debian unstable (LP: #2153367), remaining changes:", " * d/p/nvme-disk-size.patch:", " - use upstream candidate fix for getting the size of nvme drives", " * Dropped patches CVE-2026-26103 and CVE-2026-26104 included upstream", "" ], "package": "udisks2", "version": "2.11.1-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153367 ], "author": "Graham Inggs ", "date": "Sun, 12 Jul 2026 12:24:44 +0000" }, { "cves": [], "log": [ "", " * Bump debhelper-compat to 14", " * Bump Standards-Version to 4.7.4", " * Revert \"Skip MDRaid test as it depends on targetcli-fb\"", " * Fix integration test test_exfat with exfatprogs >= 1.4.0 (Closes: #1141111)", "" ], "package": "udisks2", "version": "2.11.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Wed, 01 Jul 2026 20:10:23 +0200" }, { "cves": [ { "cve": "CVE-2026-26103", "url": "https://ubuntu.com/security/CVE-2026-26103", "cve_description": "A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" }, { "cve": "CVE-2026-26104", "url": "https://ubuntu.com/security/CVE-2026-26104", "cve_description": "A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.", "cve_priority": "medium", "cve_public_date": "2026-02-25 11:16:00 UTC" } ], "log": [ "", " * New upstream version 2.11.1", " - Add missing polkit checks for RestoreEncryptedHeader() and", " HeaderBackup(). (CVE-2026-26103, CVE-2026-26104)", "" ], "package": "udisks2", "version": "2.11.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Thu, 26 Feb 2026 16:32:10 +0100" }, { "cves": [], "log": [ "", " [ Jeremy Bícha ]", " * Remove unnecessary Suggests: devhelp", "", " [ Michael Biebl ]", " * Remove redundant Priority and Rules-Requires-Root field", " * Bump Standards-Version to 4.7.3", " * Drop reisefsprogs from Suggests and autopkgtest Depends.", " ReiserFS support has been removed in Linux 6.13 and the reiserfsprogs", " package was removed from the archive accordingly.", " * Skip MDRaid test as it depends on targetcli-fb.", " The targetcli-fb package and its dependencies are currently not", " available in testing. See #1124263.", "" ], "package": "udisks2", "version": "2.11.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Thu, 12 Feb 2026 17:49:24 +0100" }, { "cves": [], "log": [ "", " * New upstream version 2.11.0", " * Bump minimum required version of libblockdev to >= 3.4", " * Drop patches, merged upstream", " * Update symbols file for libudisks2-0", "" ], "package": "udisks2", "version": "2.11.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Biebl ", "date": "Tue, 18 Nov 2025 21:43:32 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "update-manager-core", "from_version": { "source_package_name": "update-manager", "source_package_version": "1:26.04.5", "version": "1:26.04.5" }, "to_version": { "source_package_name": "update-manager", "source_package_version": "1:26.10.1", "version": "1:26.10.1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Nathan Pratta Teodosio ]", " * Switch from RequestReboot to Reboot", " * Turn inhbit_sleep into a no-op.", " * Fix normal updates being shadowed by unavailable Pro counterparts.", " * Remove prompt to enable Pro if already attached.", " * Fix linter warnings.", "", " [ Alessandro Astone ]", " * Re-introduce accidentally dropped import statement", " * Drop duplicate import statement", "" ], "package": "update-manager", "version": "1:26.10.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Wed, 01 Jul 2026 16:52:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "update-notifier-common", "from_version": { "source_package_name": "update-notifier", "source_package_version": "3.208", "version": "3.208" }, "to_version": { "source_package_name": "update-notifier", "source_package_version": "3.209", "version": "3.209" }, "cves": [], "launchpad_bugs_fixed": [ 2159587 ], "changes": [ { "cves": [], "log": [ "", " * update: Always show notification if requested (LP: #2159587).", " - There is no reason for mandating the appindicator to be visible before", " showing a desktop notification; in facts, in most cases the appindicator", " won't be visible.", " - Likewise, APT may be running for other reasons (e.g. installing something", " via the App Center, or running unattended-upgrades for a partial", " security-only update) but we still want to show a notification that more", " updates are available. Update Manager can handle being launched while APT", " is running.", "" ], "package": "update-notifier", "version": "3.209", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2159587 ], "author": "Alessandro Astone ", "date": "Thu, 23 Jul 2026 14:34:40 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "usb.ids", "from_version": { "source_package_name": "usb.ids", "source_package_version": "2025.12.13-1", "version": "2025.12.13-1" }, "to_version": { "source_package_name": "usb.ids", "source_package_version": "2026.06.26-1", "version": "2026.06.26-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version.", " * Bump Standards-Version to 4.7.4 (no changes).", "" ], "package": "usb.ids", "version": "2026.06.26-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Aurelien Jarno ", "date": "Fri, 26 Jun 2026 23:21:06 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "whiptail", "from_version": { "source_package_name": "newt", "source_package_version": "0.52.25-1ubuntu3", "version": "0.52.25-1ubuntu3" }, "to_version": { "source_package_name": "newt", "source_package_version": "0.52.25-2ubuntu1", "version": "0.52.25-2ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2153340 ], "changes": [ { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #2153340), remaining changes:", " + Remove libnewt0.52.preinst altogether, which contains destructive", " operations with none of the appropriate version guards", " + Add correct build-dependencies on python3-all-dbg and", " libpython3-all-dbg, needed due to debian/patches/snack.patch", " + Don't install python-newt example files", " + Install/remove alternatives for the ubuntu palette", " + Revert Debian's dropping of /etc/newt/palette.original, used as an", " alternative in Ubuntu", "" ], "package": "newt", "version": "0.52.25-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153340 ], "author": "Graham Inggs ", "date": "Tue, 14 Jul 2026 15:34:38 +0000" }, { "cves": [], "log": [ "", " * Update VCS after repo move", " * Drop priority: optional", " * Standards-Version: 4.7.3", " * Drop leading / in install files debian/*.install", " * Change http: to https: in debian/patches/*", " * d/control: remove obsolete versioning dependencies", " * Updated Kazakh patch. Closes: #1126118", "" ], "package": "newt", "version": "0.52.25-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alastair McKinstry ", "date": "Fri, 13 Feb 2026 06:34:38 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "xkb-data", "from_version": { "source_package_name": "xkeyboard-config", "source_package_version": "2.46-2", "version": "2.46-2" }, "to_version": { "source_package_name": "xkeyboard-config", "source_package_version": "2.47-1", "version": "2.47-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", "" ], "package": "xkeyboard-config", "version": "2.47-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Mon, 30 Mar 2026 14:39:43 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g:riscv64", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg+really1.3.1-1ubuntu3", "version": "1:1.3.dfsg+really1.3.1-1ubuntu3" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg+really1.3.2-3ubuntu1", "version": "1:1.3.dfsg+really1.3.2-3ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2153372 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153372). Remaining changes:", " - d/zlib-core.symbols: Drop dfsg suffix from version", " - Add watch file, with GPG tarball checking, and version mangling", " - Build x32 packages", " - Fix build for package metadata", " * Dropped changes, included in Debian:", " - Stop building 32bit lib on s390x (LP #2075313)", " * Dropped s390x and power optimizations for now. These patches no longer", " apply, and require additional contrib code that is not included in Debian.", " Furthermore, due to a mistake in debian/rules, the s390x build has", " not enabled DFLTCC for the last couple releases. Dropped changes:", " - d/rules: Compile with DFLTCC enabled on s390x and", " hardware compression at level 6 (LP #1823157, LP #1884514)", " - d/p/power/*: Add optimized crc32 for POWER8+", " - d/p/s390x/*: Add optimized crc32 and hardware deflate", " * New changes:", " - d/libminizip1t64.symbols: Drop dfsg suffix from version", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.2-3ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153372 ], "author": "Nick Rosbrook ", "date": "Tue, 16 Jun 2026 08:36:08 -0400" }, { "cves": [], "log": [ "", " * Suppress crcvx to fix building of minizip on s390 with patch", " from Adrian Bunk (closes: #1132458).", " * Fix up missing --host from prior minizip patch (closes: #1050995).", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.2-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Brown ", "date": "Wed, 01 Apr 2026 22:50:49 +0100" }, { "cves": [], "log": [ "", " * Add --add-udeb=zlib1g-udeb to the dh_makeshlibs call for all", " lib32z1, lib64z1, and libn32z1 packages, avoiding dependencies like", " zlib1g-udeb → lib32z1 on amd64, using a patch provided by Cyril", " Brulebois (closes: #1132159).", " * Fix upstream issue with not installing all minizip headers using a", " patch from Bas Couwenberg (closes: #1132119).", " * Reintroduce support for cross building with work from Helmut ", " Grohne (closes: #1050995).", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.2-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Brown ", "date": "Sat, 28 Mar 2026 17:55:24 +0100" }, { "cves": [], "log": [ "", " * New upstream release.", " * Don't create /lib, patch from Michael Biebl (closes: #1126919).", " * minizip now has a testsuite, run it.", " * Bump debhelper compat to 15 (no changes).", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.2-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Brown ", "date": "Tue, 24 Mar 2026 01:05:33 +0000" }, { "cves": [], "log": [ "", " * Apply fixup for s390x removal from Helmut Grohne (closes: #1127743).", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Brown ", "date": "Mon, 16 Feb 2026 14:40:58 +0000" }, { "cves": [], "log": [ "", " * Stop building lib32z1 on s390x using patch from Aurelien Jarno", " , due to an uncoordinated upload of gcc-defaults", " there will be some temporary problems with testing migration as", " things sort themselves out (closes: #1125669).", " * Flag that we support noudeb (closes: #1024936).", " * Enable autopkgtest using patch from Sahithi Akunuri", " (closes: #1113755).", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Mark Brown ", "date": "Sat, 31 Jan 2026 12:50:16 +0000" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "dbus-broker", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "dbus-broker", "source_package_version": "37-5ubuntu5", "version": "37-5ubuntu5" }, "cves": [], "launchpad_bugs_fixed": [ 2015538 ], "changes": [ { "cves": [], "log": [ "", " * d/control: Provide default default-dbus-system-bus", " dbus-broker will be the default system bus provider in Ubuntu.", " (LP: #2015538)", "" ], "package": "dbus-broker", "version": "37-5ubuntu5", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2015538 ], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 17:47:32 +0200" }, { "cves": [], "log": [ "", " * d/p: Update apparmor logging patches from upstream", " * d/p: Fix apparmor logging of bind denials", " * d/p: Change fix for FD exhaustion from upstream", " * d/p: Fix accounting pidfds per peer", "" ], "package": "dbus-broker", "version": "37-5ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Tue, 14 Jul 2026 09:50:04 +0200" }, { "cves": [], "log": [ "", " * d/p: Fix connect-policies based on GIDs", " * d/p: Fix crash on FD exhaustion", " * d/p: Log apparmor denials from the session bus", "" ], "package": "dbus-broker", "version": "37-5ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Mon, 22 Jun 2026 14:37:32 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "linux-headers-7.1.0-5-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": null }, "to_version": { "source_package_name": "linux-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158456, 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 1786013, 2154174, 2152714, 2148866, 2149808, 2148718, 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537, 2147403, 2136820, 2147447, 2144712, 2116144, 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477, 2144865, 2144735, 2142775, 2144652, 2143197, 2139276, 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.2 -proposed tracker (LP: #2158456)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Fix packaging by removing amd64-only linux-lib-rust", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158456 ], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:45:40 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.1 -proposed tracker (LP: #2157018)", "", " * Excessive size of kernel modules on RISC-V - modules unstripped", " (LP: #1964335)", " - SAUCE: scripts/Makefile.modinst discard-locals from modules", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-5.5 ]", "", " * stonking/linux: 7.1.0-5.5 -proposed tracker (LP: #2156849)", " * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260", " renders upside-down (LP: #2155837)", " - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14", " Premium PA14260", " * ov08x40 module mounted upside down on a certain DELL platforms", " (LP: #2146517)", " - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with", " upside down sensors", " - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside", " down sensors", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", " - [Config] updateconfigs after v7.1 rebase", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Sarah Emery ", "date": "Mon, 22 Jun 2026 16:39:05 +0200" }, { "cves": [], "log": [ "", " * Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-4.4 ]", "" ], "package": "linux-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Tue, 16 Jun 2026 10:37:24 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux: 7.1.0-4.4 -proposed tracker (LP: #2154256)", "", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", "", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", "" ], "package": "linux", "version": "7.1.0-4.4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Timo Aaltonen ", "date": "Sat, 06 Jun 2026 14:31:44 +0300" }, { "cves": [], "log": [ "", " * stonking/linux: 7.1.0-1.1 -proposed tracker (LP: #2154256)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue", " (LP: #2154174)", " - SAUCE: selftests/seccomp fix compilation issue for amd64", "", " * Kernel 6.19-rc8 does not include GPIB driver (LP: #2152714)", " - [Config] Enable CONFIG_GPIB for amd64", "", " * Miscellaneous Ubuntu changes", " - Update Changes.md after v7.1-rc4 rebase", " - [packaging] Install gdb scripts again", " - [Config] updateconfigs after v7.1-rc5 rebase", " - [Packaging] templates: Use a for-loop for run-parts", " - [Packaging] Remove dead debian.master/rules.d/x32.mk", " - [Packaging] Remove orphaned debian/v4l2loopback-modules.ignore", " - [Packaging] Remove orphaned debian/zfs-modules.ignore", " - [Packaging] Remove deprecated linux-doc transitional stub", " - [Packaging] Remove dead comment referencing gcc-4.7 in control.stub.in", " - [Packaging] Remove dead comment in ppc64el.mk", " - [Packaging] Remove stale legacy code", " - [Packaging] rules: Drop an obsolete check for do_zstd_ko", " - [Config] toolchain version update", " - [Packaging] update Ubuntu.md", "" ], "package": "linux", "version": "7.1.0-1.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 1786013, 2154174, 2152714 ], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 16:08:55 +0300" }, { "cves": [], "log": [ "", " * Dummy entry.", "" ], "package": "linux", "version": "7.1.0-0.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 09:59:13 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)", "", " * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown", " (LP: #2149808)", " - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes", "", " * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest", " Resolute kernels, breaking Secure Boot systems (LP: #2148718)", " - [packaging] add intel-ipu7 to signature inclusion list", "" ], "package": "linux", "version": "7.0.0-15.15", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148866, 2149808, 2148718 ], "author": "Paolo Pisati ", "date": "Wed, 22 Apr 2026 16:02:19 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)", "", " * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)", " - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471", "", " * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)", " - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", "", " * System doesn't response with mt76 call trace (LP: #2137448)", " - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations", "", " * The second tbt storage plugged on the dock will not be recognized", " (LP: #2139572)", " - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan", "", " * dma-buf filesystem flags fix (LP: #2139656)", " - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem", "", " * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17", " (LP: #2145164)", " - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on", " enumeration failure", "", " * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during", " long HPD pulse (LP: #2143879)", " - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port", " during long HPD pulse", "", " * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)", " - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug", " message", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add support for per-flavour depends", " - [Packaging] Don't hard-code lmm zfs dependency", " - [Config] updateconfigs following v7.0 release", "" ], "package": "linux", "version": "7.0.0-14.14", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537 ], "author": "Paolo Pisati ", "date": "Mon, 13 Apr 2026 10:12:22 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)", "", " * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)", " - SAUCE increase socat timeout in gre_gso.sh", "", " * Canonical Kmod 2025 key rotation (LP: #2147447)", " - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing", " extensible", " - [Packaging] ubuntu-compatible-signing -- allow consumption of positive", " certs", " - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key", " - [Config] prepare for Canonical Kmod key rotation", " - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key", " - [Packaging] ensure our cert rollups are always fresh", "", " * On Dell system, the internal OLED display drops to a visibly low FPS after", " suspend/resume (LP: #2144712)", " - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk", " - drm/i915/psr: Fixes for Dell XPS DA14260 quirk", "", " * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)", " - SAUCE: r8169: add quirk for RTL8116af SerDes", "", " * Miscellaneous Ubuntu changes", " - [Config] updateconfigs following v7.0-rc7 rebase", "" ], "package": "linux", "version": "7.0.0-13.13", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147403, 2136820, 2147447, 2144712, 2116144 ], "author": "Paolo Pisati ", "date": "Wed, 08 Apr 2026 06:56:37 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-12.12 -proposed tracker (LP: #2146778)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * linux-generic does not run scripts in /usr/share/kernel/*.d (LP: #2147005)", " - [Packaging] templates: Use consistent indentation", " - [Packaging] templates: Run scripts in /usr/share/kernel/*.d too", "", " * RISC-V kernel config is out of sync with other archs (LP: #1981437)", " - [Config] riscv64: Enable COUNTER=m", " - [Config] riscv64: Use GENDWARFKSYMS like other architectures", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [30/57]: apparmor-next 7.1: aapparmor: use target", " task's context in apparmor_getprocattr()", " - SAUCE: apparmor5.0.0 [31/57]: apparmor-next 7.1: apparmor: return error", " on namespace mismatch in verify_header", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [34/57]: apparmor-next 7.1: apparmor: Replace", " memcpy + NUL termination with kmemdup_nul in do_setattr", " - SAUCE: apparmor5.0.0 [35/57]: apparmor-next 7.1: apparmor: Remove", " redundant if check in sk_peer_get_label", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [40/57]: apparmor-next 7.1: apparmor: Use", " sysfs_emit in param_get_{audit,mode}", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [46/57]: apparmor-next 7.1: apparmor: Fix string", " overrun due to missing termination", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Enable new Intel WCL soundwire support (LP: #2143301)", " - ASoC: sdw_utils: Add CS42L43B codec info", " - ASoC: dt-bindings: cirrus, cs42l43: Add CS42L43B variant", " - mfd: cs42l43: Add support for the B variant", " - ASoC: cs42l43: Add support for the B variant", "", " * Enable audio functions on Dell Huracan/Renegade platforms w/o built-in", " microphone (LP: #2143902)", " - ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay", " - ASoC: SDCA: Update counting of SU/GE DAPM routes", " - ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes", " - ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops", " - ASoC: add snd_soc_lookup_component_by_name helper", " - ASoC: soc_sdw_utils: partial match the codec name", " - ASoC: soc_sdw_utils: remove index from sdca codec name", "", " * [SRU] MIPI camera is not working after upgrading to 6.17-oem", " (LP: #2145171)", " - SAUCE: ACPI: respect items already in honor_dep before skipping", "", " * linux-tools: consider linking perf against LLVM (LP: #2138328)", " - [Packaging] Actually enable llvm for perf", "", " * Pull patch in qla2xxx to Resolute (LP: #2144856)", " - scsi: qla2xxx: Add support to report MPI FW state", "", " * Ubuntu Resolute Desktop image arm64 - Boot on SC8280XP stalls with gpi-dma", " errors (LP: #2142403)", " - Revert \"arm64: dts: qcom: sc8280xp: Enable GPI DMA\"", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: arm64: dts: add missing denali-oled.dtb to Makefile", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMCC block definition", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa", " and Purwa variants", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device", " tree", " - SAUCE: firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100", " variant", " - SAUCE: arm64: dts: qcom: hamoa: Move PCIe PERST and Wake GPIOs to port", " nodes", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: wip: arm64: dts: qcom: x1e78100-t14s: enable bluetooth", "", " * Miscellaneous Ubuntu changes", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - [Config] PHY_QCOM_MIPI_CSI2=m", " - SAUCE: arm64: dts: x1e80100-lenovo-yoga-slim7x: Fix RGB camera supplies", " - [Config] toolchain version update", " - Update Changes.md after v7.0-rc5 rebase", " - [Packaging] update Ubuntu.md", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Add linux-main-modules-zfs to linux-modules depends", "", " * Miscellaneous upstream changes", " - Revert \"UBUNTU: SAUCE: Add Bluetooth support for the Lenovo Yoga Slim", " 7x\"", "" ], "package": "linux", "version": "7.0.0-12.12", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477 ], "author": "Timo Aaltonen ", "date": "Thu, 02 Apr 2026 11:50:22 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-10.10 -proposed tracker (LP: #2144865)", "", " * Miscellaneous upstream changes", " - Revert \"powerpc: fix KUAP warning in VMX usercopy path\"", "" ], "package": "linux", "version": "7.0.0-10.10", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144865 ], "author": "Paolo Pisati ", "date": "Thu, 19 Mar 2026 09:44:11 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-9.9 -proposed tracker (LP: #2144735)", "", " * Please make dracut the default initrd generator (LP: #2142775)", " - [Packaging] recommends dracut instead of initramfs-tools", "", " * Miscellaneous Ubuntu changes", " - SAUCE: Change RISC-V target to RVA23 (riscv64a23-unknown-linux-gnu)", "" ], "package": "linux", "version": "7.0.0-9.9", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144735, 2142775 ], "author": "Paolo Pisati ", "date": "Wed, 18 Mar 2026 13:11:06 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-8.8 -proposed tracker (LP: #2144652)", "", " * UBUNTU: SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", " (LP: #2143197)", " - SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", "", " * [usrmerge] evaluate kernel owned packages for DEP17 compliance", " (LP: #2139276)", " - [Packaging] Install modules in /usr/lib/modules", "", " * Miscellaneous Ubuntu changes", " - [Config] hardening: enable LIST_HARDENED", " - [Config] hardening: disable LDISC_AUTOLOAD", " - [Config] hardening: disable LEGACY_PTYS", " - [Config] updateconfigs following v7.0-rc4 rebase", "" ], "package": "linux", "version": "7.0.0-8.8", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144652, 2143197, 2139276 ], "author": "Paolo Pisati ", "date": "Tue, 17 Mar 2026 18:01:36 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-7.7 -proposed tracker (LP: #2143974)", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/29]: apparmor: fix fine grained inet mediation", " sock_file_perm", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/29]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/29]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/29]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/29]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/29]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/29]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/29]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/29]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/29]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/29]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/29]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/29]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/29]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/29]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/29]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/29]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/29]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/29]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/29]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/29]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/29]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/29]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/29]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/29]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/29]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/29]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/29]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/29]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * NPU utilization on amdxdna is missing (LP: #2143243)", " - SAUCE: accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate", " - SAUCE: accel/amdxdna: Support sensors for column utilization", " - SAUCE: accel/amdxdna: Import AMD_PMF namespace", "", " * Adopting dark mode by default for OLED panel (LP: #2143203)", " - SAUCE: drm/connector: Add a new 'panel_type' property", " - SAUCE: drm/amd/display: Attach OLED property to eDP panels", "", " * Support AMD Image Signal Processing (ISP) unit V4.0 (LP: #2110092)", " - SAUCE: media: platform: amd: Introduce amd isp4 capture driver", " - SAUCE: media: platform: amd: low level support for isp4 firmware", " - SAUCE: media: platform: amd: Add isp4 fw and hw interface", " - SAUCE: media: platform: amd: isp4 subdev and firmware loading handling", " added", " - SAUCE: media: platform: amd: isp4 video node and buffers handling added", " - SAUCE: Documentation: add documentation of AMD isp 4 driver", " - SAUCE: media: platform: amd: isp4 debug fs logging and more descriptive", " errors", " - [Config] Enable VIDEO_AMD_ISP4_CAPTURE", "", " * Miscellaneous Ubuntu changes", " - [Config] temporarily disable OBJTOOL_WERROR", "" ], "package": "linux", "version": "7.0.0-7.7", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "author": "Paolo Pisati ", "date": "Thu, 12 Mar 2026 10:49:34 +0100" } ], "notes": "linux-headers-7.1.0-5-generic version '7.1.0-5.5.2' (source package linux-riscv version '7.1.0-5.5.2') was added. linux-headers-7.1.0-5-generic version '7.1.0-5.5.2' has the same source package name, linux-riscv, as removed package linux-headers-7.0.0-14-generic. As such we can use the source package version of the removed package, '7.0.0-14.14.2', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-7.1.0-5-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": null }, "to_version": { "source_package_name": "linux-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158456, 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 1786013, 2154174, 2152714, 2148866, 2149808, 2148718, 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537, 2147403, 2136820, 2147447, 2144712, 2116144, 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477, 2144865, 2144735, 2142775, 2144652, 2143197, 2139276, 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.2 -proposed tracker (LP: #2158456)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Fix packaging by removing amd64-only linux-lib-rust", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158456 ], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:45:40 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.1 -proposed tracker (LP: #2157018)", "", " * Excessive size of kernel modules on RISC-V - modules unstripped", " (LP: #1964335)", " - SAUCE: scripts/Makefile.modinst discard-locals from modules", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-5.5 ]", "", " * stonking/linux: 7.1.0-5.5 -proposed tracker (LP: #2156849)", " * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260", " renders upside-down (LP: #2155837)", " - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14", " Premium PA14260", " * ov08x40 module mounted upside down on a certain DELL platforms", " (LP: #2146517)", " - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with", " upside down sensors", " - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside", " down sensors", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", " - [Config] updateconfigs after v7.1 rebase", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Sarah Emery ", "date": "Mon, 22 Jun 2026 16:39:05 +0200" }, { "cves": [], "log": [ "", " * Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-4.4 ]", "" ], "package": "linux-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Tue, 16 Jun 2026 10:37:24 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux: 7.1.0-4.4 -proposed tracker (LP: #2154256)", "", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", "", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", "" ], "package": "linux", "version": "7.1.0-4.4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Timo Aaltonen ", "date": "Sat, 06 Jun 2026 14:31:44 +0300" }, { "cves": [], "log": [ "", " * stonking/linux: 7.1.0-1.1 -proposed tracker (LP: #2154256)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue", " (LP: #2154174)", " - SAUCE: selftests/seccomp fix compilation issue for amd64", "", " * Kernel 6.19-rc8 does not include GPIB driver (LP: #2152714)", " - [Config] Enable CONFIG_GPIB for amd64", "", " * Miscellaneous Ubuntu changes", " - Update Changes.md after v7.1-rc4 rebase", " - [packaging] Install gdb scripts again", " - [Config] updateconfigs after v7.1-rc5 rebase", " - [Packaging] templates: Use a for-loop for run-parts", " - [Packaging] Remove dead debian.master/rules.d/x32.mk", " - [Packaging] Remove orphaned debian/v4l2loopback-modules.ignore", " - [Packaging] Remove orphaned debian/zfs-modules.ignore", " - [Packaging] Remove deprecated linux-doc transitional stub", " - [Packaging] Remove dead comment referencing gcc-4.7 in control.stub.in", " - [Packaging] Remove dead comment in ppc64el.mk", " - [Packaging] Remove stale legacy code", " - [Packaging] rules: Drop an obsolete check for do_zstd_ko", " - [Config] toolchain version update", " - [Packaging] update Ubuntu.md", "" ], "package": "linux", "version": "7.1.0-1.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 1786013, 2154174, 2152714 ], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 16:08:55 +0300" }, { "cves": [], "log": [ "", " * Dummy entry.", "" ], "package": "linux", "version": "7.1.0-0.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 09:59:13 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)", "", " * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown", " (LP: #2149808)", " - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes", "", " * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest", " Resolute kernels, breaking Secure Boot systems (LP: #2148718)", " - [packaging] add intel-ipu7 to signature inclusion list", "" ], "package": "linux", "version": "7.0.0-15.15", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148866, 2149808, 2148718 ], "author": "Paolo Pisati ", "date": "Wed, 22 Apr 2026 16:02:19 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)", "", " * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)", " - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471", "", " * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)", " - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", "", " * System doesn't response with mt76 call trace (LP: #2137448)", " - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations", "", " * The second tbt storage plugged on the dock will not be recognized", " (LP: #2139572)", " - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan", "", " * dma-buf filesystem flags fix (LP: #2139656)", " - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem", "", " * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17", " (LP: #2145164)", " - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on", " enumeration failure", "", " * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during", " long HPD pulse (LP: #2143879)", " - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port", " during long HPD pulse", "", " * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)", " - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug", " message", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add support for per-flavour depends", " - [Packaging] Don't hard-code lmm zfs dependency", " - [Config] updateconfigs following v7.0 release", "" ], "package": "linux", "version": "7.0.0-14.14", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537 ], "author": "Paolo Pisati ", "date": "Mon, 13 Apr 2026 10:12:22 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)", "", " * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)", " - SAUCE increase socat timeout in gre_gso.sh", "", " * Canonical Kmod 2025 key rotation (LP: #2147447)", " - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing", " extensible", " - [Packaging] ubuntu-compatible-signing -- allow consumption of positive", " certs", " - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key", " - [Config] prepare for Canonical Kmod key rotation", " - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key", " - [Packaging] ensure our cert rollups are always fresh", "", " * On Dell system, the internal OLED display drops to a visibly low FPS after", " suspend/resume (LP: #2144712)", " - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk", " - drm/i915/psr: Fixes for Dell XPS DA14260 quirk", "", " * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)", " - SAUCE: r8169: add quirk for RTL8116af SerDes", "", " * Miscellaneous Ubuntu changes", " - [Config] updateconfigs following v7.0-rc7 rebase", "" ], "package": "linux", "version": "7.0.0-13.13", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147403, 2136820, 2147447, 2144712, 2116144 ], "author": "Paolo Pisati ", "date": "Wed, 08 Apr 2026 06:56:37 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-12.12 -proposed tracker (LP: #2146778)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * linux-generic does not run scripts in /usr/share/kernel/*.d (LP: #2147005)", " - [Packaging] templates: Use consistent indentation", " - [Packaging] templates: Run scripts in /usr/share/kernel/*.d too", "", " * RISC-V kernel config is out of sync with other archs (LP: #1981437)", " - [Config] riscv64: Enable COUNTER=m", " - [Config] riscv64: Use GENDWARFKSYMS like other architectures", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [30/57]: apparmor-next 7.1: aapparmor: use target", " task's context in apparmor_getprocattr()", " - SAUCE: apparmor5.0.0 [31/57]: apparmor-next 7.1: apparmor: return error", " on namespace mismatch in verify_header", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [34/57]: apparmor-next 7.1: apparmor: Replace", " memcpy + NUL termination with kmemdup_nul in do_setattr", " - SAUCE: apparmor5.0.0 [35/57]: apparmor-next 7.1: apparmor: Remove", " redundant if check in sk_peer_get_label", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [40/57]: apparmor-next 7.1: apparmor: Use", " sysfs_emit in param_get_{audit,mode}", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [46/57]: apparmor-next 7.1: apparmor: Fix string", " overrun due to missing termination", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Enable new Intel WCL soundwire support (LP: #2143301)", " - ASoC: sdw_utils: Add CS42L43B codec info", " - ASoC: dt-bindings: cirrus, cs42l43: Add CS42L43B variant", " - mfd: cs42l43: Add support for the B variant", " - ASoC: cs42l43: Add support for the B variant", "", " * Enable audio functions on Dell Huracan/Renegade platforms w/o built-in", " microphone (LP: #2143902)", " - ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay", " - ASoC: SDCA: Update counting of SU/GE DAPM routes", " - ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes", " - ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops", " - ASoC: add snd_soc_lookup_component_by_name helper", " - ASoC: soc_sdw_utils: partial match the codec name", " - ASoC: soc_sdw_utils: remove index from sdca codec name", "", " * [SRU] MIPI camera is not working after upgrading to 6.17-oem", " (LP: #2145171)", " - SAUCE: ACPI: respect items already in honor_dep before skipping", "", " * linux-tools: consider linking perf against LLVM (LP: #2138328)", " - [Packaging] Actually enable llvm for perf", "", " * Pull patch in qla2xxx to Resolute (LP: #2144856)", " - scsi: qla2xxx: Add support to report MPI FW state", "", " * Ubuntu Resolute Desktop image arm64 - Boot on SC8280XP stalls with gpi-dma", " errors (LP: #2142403)", " - Revert \"arm64: dts: qcom: sc8280xp: Enable GPI DMA\"", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: arm64: dts: add missing denali-oled.dtb to Makefile", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMCC block definition", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa", " and Purwa variants", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device", " tree", " - SAUCE: firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100", " variant", " - SAUCE: arm64: dts: qcom: hamoa: Move PCIe PERST and Wake GPIOs to port", " nodes", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: wip: arm64: dts: qcom: x1e78100-t14s: enable bluetooth", "", " * Miscellaneous Ubuntu changes", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - [Config] PHY_QCOM_MIPI_CSI2=m", " - SAUCE: arm64: dts: x1e80100-lenovo-yoga-slim7x: Fix RGB camera supplies", " - [Config] toolchain version update", " - Update Changes.md after v7.0-rc5 rebase", " - [Packaging] update Ubuntu.md", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Add linux-main-modules-zfs to linux-modules depends", "", " * Miscellaneous upstream changes", " - Revert \"UBUNTU: SAUCE: Add Bluetooth support for the Lenovo Yoga Slim", " 7x\"", "" ], "package": "linux", "version": "7.0.0-12.12", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477 ], "author": "Timo Aaltonen ", "date": "Thu, 02 Apr 2026 11:50:22 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-10.10 -proposed tracker (LP: #2144865)", "", " * Miscellaneous upstream changes", " - Revert \"powerpc: fix KUAP warning in VMX usercopy path\"", "" ], "package": "linux", "version": "7.0.0-10.10", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144865 ], "author": "Paolo Pisati ", "date": "Thu, 19 Mar 2026 09:44:11 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-9.9 -proposed tracker (LP: #2144735)", "", " * Please make dracut the default initrd generator (LP: #2142775)", " - [Packaging] recommends dracut instead of initramfs-tools", "", " * Miscellaneous Ubuntu changes", " - SAUCE: Change RISC-V target to RVA23 (riscv64a23-unknown-linux-gnu)", "" ], "package": "linux", "version": "7.0.0-9.9", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144735, 2142775 ], "author": "Paolo Pisati ", "date": "Wed, 18 Mar 2026 13:11:06 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-8.8 -proposed tracker (LP: #2144652)", "", " * UBUNTU: SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", " (LP: #2143197)", " - SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", "", " * [usrmerge] evaluate kernel owned packages for DEP17 compliance", " (LP: #2139276)", " - [Packaging] Install modules in /usr/lib/modules", "", " * Miscellaneous Ubuntu changes", " - [Config] hardening: enable LIST_HARDENED", " - [Config] hardening: disable LDISC_AUTOLOAD", " - [Config] hardening: disable LEGACY_PTYS", " - [Config] updateconfigs following v7.0-rc4 rebase", "" ], "package": "linux", "version": "7.0.0-8.8", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144652, 2143197, 2139276 ], "author": "Paolo Pisati ", "date": "Tue, 17 Mar 2026 18:01:36 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-7.7 -proposed tracker (LP: #2143974)", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/29]: apparmor: fix fine grained inet mediation", " sock_file_perm", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/29]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/29]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/29]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/29]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/29]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/29]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/29]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/29]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/29]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/29]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/29]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/29]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/29]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/29]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/29]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/29]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/29]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/29]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/29]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/29]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/29]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/29]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/29]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/29]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/29]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/29]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/29]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/29]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * NPU utilization on amdxdna is missing (LP: #2143243)", " - SAUCE: accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate", " - SAUCE: accel/amdxdna: Support sensors for column utilization", " - SAUCE: accel/amdxdna: Import AMD_PMF namespace", "", " * Adopting dark mode by default for OLED panel (LP: #2143203)", " - SAUCE: drm/connector: Add a new 'panel_type' property", " - SAUCE: drm/amd/display: Attach OLED property to eDP panels", "", " * Support AMD Image Signal Processing (ISP) unit V4.0 (LP: #2110092)", " - SAUCE: media: platform: amd: Introduce amd isp4 capture driver", " - SAUCE: media: platform: amd: low level support for isp4 firmware", " - SAUCE: media: platform: amd: Add isp4 fw and hw interface", " - SAUCE: media: platform: amd: isp4 subdev and firmware loading handling", " added", " - SAUCE: media: platform: amd: isp4 video node and buffers handling added", " - SAUCE: Documentation: add documentation of AMD isp 4 driver", " - SAUCE: media: platform: amd: isp4 debug fs logging and more descriptive", " errors", " - [Config] Enable VIDEO_AMD_ISP4_CAPTURE", "", " * Miscellaneous Ubuntu changes", " - [Config] temporarily disable OBJTOOL_WERROR", "" ], "package": "linux", "version": "7.0.0-7.7", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "author": "Paolo Pisati ", "date": "Thu, 12 Mar 2026 10:49:34 +0100" } ], "notes": "linux-image-7.1.0-5-generic version '7.1.0-5.5.2' (source package linux-riscv version '7.1.0-5.5.2') was added. linux-image-7.1.0-5-generic version '7.1.0-5.5.2' has the same source package name, linux-riscv, as removed package linux-headers-7.0.0-14-generic. As such we can use the source package version of the removed package, '7.0.0-14.14.2', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.1.0-5-generic", "from_version": { "source_package_name": "linux-main-signed-riscv", "source_package_version": "7.0.0-14.14.2", "version": null }, "to_version": { "source_package_name": "linux-main-signed-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 1786013, 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-14.14.2", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-main-signed-riscv", "version": "7.0.0-14.14.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Wed, 15 Apr 2026 22:05:56 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-14.14.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "", " * Miscellaneous upstream changes", " - Cleanup d/package.config from LRM config options", " - lmm: cleanup and add copyright notice", " - lmm: Fix an issue for the in-series copy phase", " - lmm: move final artifacts from /ubuntu to /kernel", " - lmm: Allow skipping specific DKMS for specific flavours at build time", " - lmm: Fix DKMS build for chroot environments", " - lmm: Add synthetic dependency for LMM package, to stop early promotion", " - lmm: Process all modules and fail only at the end if any failed", " - Revert \"lmm: Add synthetic dependency for LMM package, to stop early", " promotion\"", "" ], "package": "linux-main-signed-riscv", "version": "7.0.0-14.14.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Tue, 14 Apr 2026 15:38:35 +0200" }, { "cves": [], "log": [ "", " * Fix back headers requisites generation, fix flavour in package.config", "" ], "package": "linux-main-signed-riscv", "version": "7.0.0-12.12.1+2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Mon, 13 Apr 2026 13:28:18 +0200" }, { "cves": [], "log": [ "", " * Fix dependency name for linux-riscv", "" ], "package": "linux-main-signed-riscv", "version": "7.0.0-12.12.1+1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Wed, 08 Apr 2026 10:07:17 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.0.0-12.12.1", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.03.30)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Initial configuration of resolute:linux-riscv", " - [Packaging] Fix dependency name for linux-riscv", "" ], "package": "linux-main-signed-riscv", "version": "7.0.0-12.12.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Sarah Emery ", "date": "Tue, 07 Apr 2026 15:45:29 +0200" } ], "notes": "linux-main-modules-zfs-7.1.0-5-generic version '7.1.0-5.5.2' (source package linux-main-signed-riscv version '7.1.0-5.5.2') was added. linux-main-modules-zfs-7.1.0-5-generic version '7.1.0-5.5.2' has the same source package name, linux-main-signed-riscv, as removed package linux-main-modules-zfs-7.0.0-14-generic. As such we can use the source package version of the removed package, '7.0.0-14.14.2', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.1.0-5-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": null }, "to_version": { "source_package_name": "linux-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158456, 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 1786013, 2154174, 2152714, 2148866, 2149808, 2148718, 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537, 2147403, 2136820, 2147447, 2144712, 2116144, 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477, 2144865, 2144735, 2142775, 2144652, 2143197, 2139276, 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.2 -proposed tracker (LP: #2158456)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Fix packaging by removing amd64-only linux-lib-rust", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158456 ], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:45:40 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.1 -proposed tracker (LP: #2157018)", "", " * Excessive size of kernel modules on RISC-V - modules unstripped", " (LP: #1964335)", " - SAUCE: scripts/Makefile.modinst discard-locals from modules", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-5.5 ]", "", " * stonking/linux: 7.1.0-5.5 -proposed tracker (LP: #2156849)", " * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260", " renders upside-down (LP: #2155837)", " - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14", " Premium PA14260", " * ov08x40 module mounted upside down on a certain DELL platforms", " (LP: #2146517)", " - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with", " upside down sensors", " - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside", " down sensors", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", " - [Config] updateconfigs after v7.1 rebase", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Sarah Emery ", "date": "Mon, 22 Jun 2026 16:39:05 +0200" }, { "cves": [], "log": [ "", " * Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-4.4 ]", "" ], "package": "linux-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Tue, 16 Jun 2026 10:37:24 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux: 7.1.0-4.4 -proposed tracker (LP: #2154256)", "", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", "", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", "" ], "package": "linux", "version": "7.1.0-4.4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Timo Aaltonen ", "date": "Sat, 06 Jun 2026 14:31:44 +0300" }, { "cves": [], "log": [ "", " * stonking/linux: 7.1.0-1.1 -proposed tracker (LP: #2154256)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue", " (LP: #2154174)", " - SAUCE: selftests/seccomp fix compilation issue for amd64", "", " * Kernel 6.19-rc8 does not include GPIB driver (LP: #2152714)", " - [Config] Enable CONFIG_GPIB for amd64", "", " * Miscellaneous Ubuntu changes", " - Update Changes.md after v7.1-rc4 rebase", " - [packaging] Install gdb scripts again", " - [Config] updateconfigs after v7.1-rc5 rebase", " - [Packaging] templates: Use a for-loop for run-parts", " - [Packaging] Remove dead debian.master/rules.d/x32.mk", " - [Packaging] Remove orphaned debian/v4l2loopback-modules.ignore", " - [Packaging] Remove orphaned debian/zfs-modules.ignore", " - [Packaging] Remove deprecated linux-doc transitional stub", " - [Packaging] Remove dead comment referencing gcc-4.7 in control.stub.in", " - [Packaging] Remove dead comment in ppc64el.mk", " - [Packaging] Remove stale legacy code", " - [Packaging] rules: Drop an obsolete check for do_zstd_ko", " - [Config] toolchain version update", " - [Packaging] update Ubuntu.md", "" ], "package": "linux", "version": "7.1.0-1.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 1786013, 2154174, 2152714 ], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 16:08:55 +0300" }, { "cves": [], "log": [ "", " * Dummy entry.", "" ], "package": "linux", "version": "7.1.0-0.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 09:59:13 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)", "", " * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown", " (LP: #2149808)", " - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes", "", " * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest", " Resolute kernels, breaking Secure Boot systems (LP: #2148718)", " - [packaging] add intel-ipu7 to signature inclusion list", "" ], "package": "linux", "version": "7.0.0-15.15", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148866, 2149808, 2148718 ], "author": "Paolo Pisati ", "date": "Wed, 22 Apr 2026 16:02:19 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)", "", " * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)", " - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471", "", " * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)", " - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", "", " * System doesn't response with mt76 call trace (LP: #2137448)", " - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations", "", " * The second tbt storage plugged on the dock will not be recognized", " (LP: #2139572)", " - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan", "", " * dma-buf filesystem flags fix (LP: #2139656)", " - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem", "", " * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17", " (LP: #2145164)", " - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on", " enumeration failure", "", " * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during", " long HPD pulse (LP: #2143879)", " - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port", " during long HPD pulse", "", " * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)", " - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug", " message", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add support for per-flavour depends", " - [Packaging] Don't hard-code lmm zfs dependency", " - [Config] updateconfigs following v7.0 release", "" ], "package": "linux", "version": "7.0.0-14.14", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537 ], "author": "Paolo Pisati ", "date": "Mon, 13 Apr 2026 10:12:22 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)", "", " * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)", " - SAUCE increase socat timeout in gre_gso.sh", "", " * Canonical Kmod 2025 key rotation (LP: #2147447)", " - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing", " extensible", " - [Packaging] ubuntu-compatible-signing -- allow consumption of positive", " certs", " - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key", " - [Config] prepare for Canonical Kmod key rotation", " - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key", " - [Packaging] ensure our cert rollups are always fresh", "", " * On Dell system, the internal OLED display drops to a visibly low FPS after", " suspend/resume (LP: #2144712)", " - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk", " - drm/i915/psr: Fixes for Dell XPS DA14260 quirk", "", " * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)", " - SAUCE: r8169: add quirk for RTL8116af SerDes", "", " * Miscellaneous Ubuntu changes", " - [Config] updateconfigs following v7.0-rc7 rebase", "" ], "package": "linux", "version": "7.0.0-13.13", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147403, 2136820, 2147447, 2144712, 2116144 ], "author": "Paolo Pisati ", "date": "Wed, 08 Apr 2026 06:56:37 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-12.12 -proposed tracker (LP: #2146778)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * linux-generic does not run scripts in /usr/share/kernel/*.d (LP: #2147005)", " - [Packaging] templates: Use consistent indentation", " - [Packaging] templates: Run scripts in /usr/share/kernel/*.d too", "", " * RISC-V kernel config is out of sync with other archs (LP: #1981437)", " - [Config] riscv64: Enable COUNTER=m", " - [Config] riscv64: Use GENDWARFKSYMS like other architectures", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [30/57]: apparmor-next 7.1: aapparmor: use target", " task's context in apparmor_getprocattr()", " - SAUCE: apparmor5.0.0 [31/57]: apparmor-next 7.1: apparmor: return error", " on namespace mismatch in verify_header", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [34/57]: apparmor-next 7.1: apparmor: Replace", " memcpy + NUL termination with kmemdup_nul in do_setattr", " - SAUCE: apparmor5.0.0 [35/57]: apparmor-next 7.1: apparmor: Remove", " redundant if check in sk_peer_get_label", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [40/57]: apparmor-next 7.1: apparmor: Use", " sysfs_emit in param_get_{audit,mode}", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [46/57]: apparmor-next 7.1: apparmor: Fix string", " overrun due to missing termination", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Enable new Intel WCL soundwire support (LP: #2143301)", " - ASoC: sdw_utils: Add CS42L43B codec info", " - ASoC: dt-bindings: cirrus, cs42l43: Add CS42L43B variant", " - mfd: cs42l43: Add support for the B variant", " - ASoC: cs42l43: Add support for the B variant", "", " * Enable audio functions on Dell Huracan/Renegade platforms w/o built-in", " microphone (LP: #2143902)", " - ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay", " - ASoC: SDCA: Update counting of SU/GE DAPM routes", " - ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes", " - ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops", " - ASoC: add snd_soc_lookup_component_by_name helper", " - ASoC: soc_sdw_utils: partial match the codec name", " - ASoC: soc_sdw_utils: remove index from sdca codec name", "", " * [SRU] MIPI camera is not working after upgrading to 6.17-oem", " (LP: #2145171)", " - SAUCE: ACPI: respect items already in honor_dep before skipping", "", " * linux-tools: consider linking perf against LLVM (LP: #2138328)", " - [Packaging] Actually enable llvm for perf", "", " * Pull patch in qla2xxx to Resolute (LP: #2144856)", " - scsi: qla2xxx: Add support to report MPI FW state", "", " * Ubuntu Resolute Desktop image arm64 - Boot on SC8280XP stalls with gpi-dma", " errors (LP: #2142403)", " - Revert \"arm64: dts: qcom: sc8280xp: Enable GPI DMA\"", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: arm64: dts: add missing denali-oled.dtb to Makefile", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMCC block definition", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa", " and Purwa variants", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device", " tree", " - SAUCE: firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100", " variant", " - SAUCE: arm64: dts: qcom: hamoa: Move PCIe PERST and Wake GPIOs to port", " nodes", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: wip: arm64: dts: qcom: x1e78100-t14s: enable bluetooth", "", " * Miscellaneous Ubuntu changes", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - [Config] PHY_QCOM_MIPI_CSI2=m", " - SAUCE: arm64: dts: x1e80100-lenovo-yoga-slim7x: Fix RGB camera supplies", " - [Config] toolchain version update", " - Update Changes.md after v7.0-rc5 rebase", " - [Packaging] update Ubuntu.md", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Add linux-main-modules-zfs to linux-modules depends", "", " * Miscellaneous upstream changes", " - Revert \"UBUNTU: SAUCE: Add Bluetooth support for the Lenovo Yoga Slim", " 7x\"", "" ], "package": "linux", "version": "7.0.0-12.12", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477 ], "author": "Timo Aaltonen ", "date": "Thu, 02 Apr 2026 11:50:22 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-10.10 -proposed tracker (LP: #2144865)", "", " * Miscellaneous upstream changes", " - Revert \"powerpc: fix KUAP warning in VMX usercopy path\"", "" ], "package": "linux", "version": "7.0.0-10.10", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144865 ], "author": "Paolo Pisati ", "date": "Thu, 19 Mar 2026 09:44:11 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-9.9 -proposed tracker (LP: #2144735)", "", " * Please make dracut the default initrd generator (LP: #2142775)", " - [Packaging] recommends dracut instead of initramfs-tools", "", " * Miscellaneous Ubuntu changes", " - SAUCE: Change RISC-V target to RVA23 (riscv64a23-unknown-linux-gnu)", "" ], "package": "linux", "version": "7.0.0-9.9", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144735, 2142775 ], "author": "Paolo Pisati ", "date": "Wed, 18 Mar 2026 13:11:06 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-8.8 -proposed tracker (LP: #2144652)", "", " * UBUNTU: SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", " (LP: #2143197)", " - SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", "", " * [usrmerge] evaluate kernel owned packages for DEP17 compliance", " (LP: #2139276)", " - [Packaging] Install modules in /usr/lib/modules", "", " * Miscellaneous Ubuntu changes", " - [Config] hardening: enable LIST_HARDENED", " - [Config] hardening: disable LDISC_AUTOLOAD", " - [Config] hardening: disable LEGACY_PTYS", " - [Config] updateconfigs following v7.0-rc4 rebase", "" ], "package": "linux", "version": "7.0.0-8.8", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144652, 2143197, 2139276 ], "author": "Paolo Pisati ", "date": "Tue, 17 Mar 2026 18:01:36 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-7.7 -proposed tracker (LP: #2143974)", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/29]: apparmor: fix fine grained inet mediation", " sock_file_perm", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/29]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/29]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/29]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/29]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/29]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/29]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/29]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/29]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/29]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/29]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/29]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/29]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/29]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/29]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/29]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/29]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/29]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/29]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/29]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/29]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/29]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/29]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/29]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/29]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/29]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/29]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/29]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/29]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * NPU utilization on amdxdna is missing (LP: #2143243)", " - SAUCE: accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate", " - SAUCE: accel/amdxdna: Support sensors for column utilization", " - SAUCE: accel/amdxdna: Import AMD_PMF namespace", "", " * Adopting dark mode by default for OLED panel (LP: #2143203)", " - SAUCE: drm/connector: Add a new 'panel_type' property", " - SAUCE: drm/amd/display: Attach OLED property to eDP panels", "", " * Support AMD Image Signal Processing (ISP) unit V4.0 (LP: #2110092)", " - SAUCE: media: platform: amd: Introduce amd isp4 capture driver", " - SAUCE: media: platform: amd: low level support for isp4 firmware", " - SAUCE: media: platform: amd: Add isp4 fw and hw interface", " - SAUCE: media: platform: amd: isp4 subdev and firmware loading handling", " added", " - SAUCE: media: platform: amd: isp4 video node and buffers handling added", " - SAUCE: Documentation: add documentation of AMD isp 4 driver", " - SAUCE: media: platform: amd: isp4 debug fs logging and more descriptive", " errors", " - [Config] Enable VIDEO_AMD_ISP4_CAPTURE", "", " * Miscellaneous Ubuntu changes", " - [Config] temporarily disable OBJTOOL_WERROR", "" ], "package": "linux", "version": "7.0.0-7.7", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "author": "Paolo Pisati ", "date": "Thu, 12 Mar 2026 10:49:34 +0100" } ], "notes": "linux-modules-7.1.0-5-generic version '7.1.0-5.5.2' (source package linux-riscv version '7.1.0-5.5.2') was added. linux-modules-7.1.0-5-generic version '7.1.0-5.5.2' has the same source package name, linux-riscv, as removed package linux-headers-7.0.0-14-generic. As such we can use the source package version of the removed package, '7.0.0-14.14.2', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-riscv-headers-7.1.0-5", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": null }, "to_version": { "source_package_name": "linux-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158456, 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 1786013, 2154174, 2152714, 2148866, 2149808, 2148718, 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537, 2147403, 2136820, 2147447, 2144712, 2116144, 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477, 2144865, 2144735, 2142775, 2144652, 2143197, 2139276, 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.2 -proposed tracker (LP: #2158456)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Fix packaging by removing amd64-only linux-lib-rust", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158456 ], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:45:40 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.1 -proposed tracker (LP: #2157018)", "", " * Excessive size of kernel modules on RISC-V - modules unstripped", " (LP: #1964335)", " - SAUCE: scripts/Makefile.modinst discard-locals from modules", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-5.5 ]", "", " * stonking/linux: 7.1.0-5.5 -proposed tracker (LP: #2156849)", " * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260", " renders upside-down (LP: #2155837)", " - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14", " Premium PA14260", " * ov08x40 module mounted upside down on a certain DELL platforms", " (LP: #2146517)", " - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with", " upside down sensors", " - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside", " down sensors", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", " - [Config] updateconfigs after v7.1 rebase", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Sarah Emery ", "date": "Mon, 22 Jun 2026 16:39:05 +0200" }, { "cves": [], "log": [ "", " * Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-4.4 ]", "" ], "package": "linux-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Tue, 16 Jun 2026 10:37:24 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux: 7.1.0-4.4 -proposed tracker (LP: #2154256)", "", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", "", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", "" ], "package": "linux", "version": "7.1.0-4.4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Timo Aaltonen ", "date": "Sat, 06 Jun 2026 14:31:44 +0300" }, { "cves": [], "log": [ "", " * stonking/linux: 7.1.0-1.1 -proposed tracker (LP: #2154256)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue", " (LP: #2154174)", " - SAUCE: selftests/seccomp fix compilation issue for amd64", "", " * Kernel 6.19-rc8 does not include GPIB driver (LP: #2152714)", " - [Config] Enable CONFIG_GPIB for amd64", "", " * Miscellaneous Ubuntu changes", " - Update Changes.md after v7.1-rc4 rebase", " - [packaging] Install gdb scripts again", " - [Config] updateconfigs after v7.1-rc5 rebase", " - [Packaging] templates: Use a for-loop for run-parts", " - [Packaging] Remove dead debian.master/rules.d/x32.mk", " - [Packaging] Remove orphaned debian/v4l2loopback-modules.ignore", " - [Packaging] Remove orphaned debian/zfs-modules.ignore", " - [Packaging] Remove deprecated linux-doc transitional stub", " - [Packaging] Remove dead comment referencing gcc-4.7 in control.stub.in", " - [Packaging] Remove dead comment in ppc64el.mk", " - [Packaging] Remove stale legacy code", " - [Packaging] rules: Drop an obsolete check for do_zstd_ko", " - [Config] toolchain version update", " - [Packaging] update Ubuntu.md", "" ], "package": "linux", "version": "7.1.0-1.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 1786013, 2154174, 2152714 ], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 16:08:55 +0300" }, { "cves": [], "log": [ "", " * Dummy entry.", "" ], "package": "linux", "version": "7.1.0-0.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 09:59:13 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)", "", " * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown", " (LP: #2149808)", " - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes", "", " * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest", " Resolute kernels, breaking Secure Boot systems (LP: #2148718)", " - [packaging] add intel-ipu7 to signature inclusion list", "" ], "package": "linux", "version": "7.0.0-15.15", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148866, 2149808, 2148718 ], "author": "Paolo Pisati ", "date": "Wed, 22 Apr 2026 16:02:19 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)", "", " * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)", " - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471", "", " * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)", " - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", "", " * System doesn't response with mt76 call trace (LP: #2137448)", " - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations", "", " * The second tbt storage plugged on the dock will not be recognized", " (LP: #2139572)", " - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan", "", " * dma-buf filesystem flags fix (LP: #2139656)", " - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem", "", " * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17", " (LP: #2145164)", " - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on", " enumeration failure", "", " * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during", " long HPD pulse (LP: #2143879)", " - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port", " during long HPD pulse", "", " * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)", " - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug", " message", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add support for per-flavour depends", " - [Packaging] Don't hard-code lmm zfs dependency", " - [Config] updateconfigs following v7.0 release", "" ], "package": "linux", "version": "7.0.0-14.14", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537 ], "author": "Paolo Pisati ", "date": "Mon, 13 Apr 2026 10:12:22 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)", "", " * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)", " - SAUCE increase socat timeout in gre_gso.sh", "", " * Canonical Kmod 2025 key rotation (LP: #2147447)", " - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing", " extensible", " - [Packaging] ubuntu-compatible-signing -- allow consumption of positive", " certs", " - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key", " - [Config] prepare for Canonical Kmod key rotation", " - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key", " - [Packaging] ensure our cert rollups are always fresh", "", " * On Dell system, the internal OLED display drops to a visibly low FPS after", " suspend/resume (LP: #2144712)", " - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk", " - drm/i915/psr: Fixes for Dell XPS DA14260 quirk", "", " * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)", " - SAUCE: r8169: add quirk for RTL8116af SerDes", "", " * Miscellaneous Ubuntu changes", " - [Config] updateconfigs following v7.0-rc7 rebase", "" ], "package": "linux", "version": "7.0.0-13.13", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147403, 2136820, 2147447, 2144712, 2116144 ], "author": "Paolo Pisati ", "date": "Wed, 08 Apr 2026 06:56:37 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-12.12 -proposed tracker (LP: #2146778)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * linux-generic does not run scripts in /usr/share/kernel/*.d (LP: #2147005)", " - [Packaging] templates: Use consistent indentation", " - [Packaging] templates: Run scripts in /usr/share/kernel/*.d too", "", " * RISC-V kernel config is out of sync with other archs (LP: #1981437)", " - [Config] riscv64: Enable COUNTER=m", " - [Config] riscv64: Use GENDWARFKSYMS like other architectures", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [30/57]: apparmor-next 7.1: aapparmor: use target", " task's context in apparmor_getprocattr()", " - SAUCE: apparmor5.0.0 [31/57]: apparmor-next 7.1: apparmor: return error", " on namespace mismatch in verify_header", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [34/57]: apparmor-next 7.1: apparmor: Replace", " memcpy + NUL termination with kmemdup_nul in do_setattr", " - SAUCE: apparmor5.0.0 [35/57]: apparmor-next 7.1: apparmor: Remove", " redundant if check in sk_peer_get_label", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [40/57]: apparmor-next 7.1: apparmor: Use", " sysfs_emit in param_get_{audit,mode}", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [46/57]: apparmor-next 7.1: apparmor: Fix string", " overrun due to missing termination", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Enable new Intel WCL soundwire support (LP: #2143301)", " - ASoC: sdw_utils: Add CS42L43B codec info", " - ASoC: dt-bindings: cirrus, cs42l43: Add CS42L43B variant", " - mfd: cs42l43: Add support for the B variant", " - ASoC: cs42l43: Add support for the B variant", "", " * Enable audio functions on Dell Huracan/Renegade platforms w/o built-in", " microphone (LP: #2143902)", " - ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay", " - ASoC: SDCA: Update counting of SU/GE DAPM routes", " - ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes", " - ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops", " - ASoC: add snd_soc_lookup_component_by_name helper", " - ASoC: soc_sdw_utils: partial match the codec name", " - ASoC: soc_sdw_utils: remove index from sdca codec name", "", " * [SRU] MIPI camera is not working after upgrading to 6.17-oem", " (LP: #2145171)", " - SAUCE: ACPI: respect items already in honor_dep before skipping", "", " * linux-tools: consider linking perf against LLVM (LP: #2138328)", " - [Packaging] Actually enable llvm for perf", "", " * Pull patch in qla2xxx to Resolute (LP: #2144856)", " - scsi: qla2xxx: Add support to report MPI FW state", "", " * Ubuntu Resolute Desktop image arm64 - Boot on SC8280XP stalls with gpi-dma", " errors (LP: #2142403)", " - Revert \"arm64: dts: qcom: sc8280xp: Enable GPI DMA\"", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: arm64: dts: add missing denali-oled.dtb to Makefile", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMCC block definition", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa", " and Purwa variants", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device", " tree", " - SAUCE: firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100", " variant", " - SAUCE: arm64: dts: qcom: hamoa: Move PCIe PERST and Wake GPIOs to port", " nodes", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: wip: arm64: dts: qcom: x1e78100-t14s: enable bluetooth", "", " * Miscellaneous Ubuntu changes", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - [Config] PHY_QCOM_MIPI_CSI2=m", " - SAUCE: arm64: dts: x1e80100-lenovo-yoga-slim7x: Fix RGB camera supplies", " - [Config] toolchain version update", " - Update Changes.md after v7.0-rc5 rebase", " - [Packaging] update Ubuntu.md", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Add linux-main-modules-zfs to linux-modules depends", "", " * Miscellaneous upstream changes", " - Revert \"UBUNTU: SAUCE: Add Bluetooth support for the Lenovo Yoga Slim", " 7x\"", "" ], "package": "linux", "version": "7.0.0-12.12", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477 ], "author": "Timo Aaltonen ", "date": "Thu, 02 Apr 2026 11:50:22 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-10.10 -proposed tracker (LP: #2144865)", "", " * Miscellaneous upstream changes", " - Revert \"powerpc: fix KUAP warning in VMX usercopy path\"", "" ], "package": "linux", "version": "7.0.0-10.10", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144865 ], "author": "Paolo Pisati ", "date": "Thu, 19 Mar 2026 09:44:11 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-9.9 -proposed tracker (LP: #2144735)", "", " * Please make dracut the default initrd generator (LP: #2142775)", " - [Packaging] recommends dracut instead of initramfs-tools", "", " * Miscellaneous Ubuntu changes", " - SAUCE: Change RISC-V target to RVA23 (riscv64a23-unknown-linux-gnu)", "" ], "package": "linux", "version": "7.0.0-9.9", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144735, 2142775 ], "author": "Paolo Pisati ", "date": "Wed, 18 Mar 2026 13:11:06 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-8.8 -proposed tracker (LP: #2144652)", "", " * UBUNTU: SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", " (LP: #2143197)", " - SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", "", " * [usrmerge] evaluate kernel owned packages for DEP17 compliance", " (LP: #2139276)", " - [Packaging] Install modules in /usr/lib/modules", "", " * Miscellaneous Ubuntu changes", " - [Config] hardening: enable LIST_HARDENED", " - [Config] hardening: disable LDISC_AUTOLOAD", " - [Config] hardening: disable LEGACY_PTYS", " - [Config] updateconfigs following v7.0-rc4 rebase", "" ], "package": "linux", "version": "7.0.0-8.8", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144652, 2143197, 2139276 ], "author": "Paolo Pisati ", "date": "Tue, 17 Mar 2026 18:01:36 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-7.7 -proposed tracker (LP: #2143974)", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/29]: apparmor: fix fine grained inet mediation", " sock_file_perm", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/29]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/29]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/29]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/29]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/29]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/29]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/29]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/29]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/29]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/29]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/29]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/29]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/29]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/29]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/29]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/29]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/29]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/29]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/29]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/29]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/29]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/29]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/29]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/29]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/29]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/29]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/29]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/29]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * NPU utilization on amdxdna is missing (LP: #2143243)", " - SAUCE: accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate", " - SAUCE: accel/amdxdna: Support sensors for column utilization", " - SAUCE: accel/amdxdna: Import AMD_PMF namespace", "", " * Adopting dark mode by default for OLED panel (LP: #2143203)", " - SAUCE: drm/connector: Add a new 'panel_type' property", " - SAUCE: drm/amd/display: Attach OLED property to eDP panels", "", " * Support AMD Image Signal Processing (ISP) unit V4.0 (LP: #2110092)", " - SAUCE: media: platform: amd: Introduce amd isp4 capture driver", " - SAUCE: media: platform: amd: low level support for isp4 firmware", " - SAUCE: media: platform: amd: Add isp4 fw and hw interface", " - SAUCE: media: platform: amd: isp4 subdev and firmware loading handling", " added", " - SAUCE: media: platform: amd: isp4 video node and buffers handling added", " - SAUCE: Documentation: add documentation of AMD isp 4 driver", " - SAUCE: media: platform: amd: isp4 debug fs logging and more descriptive", " errors", " - [Config] Enable VIDEO_AMD_ISP4_CAPTURE", "", " * Miscellaneous Ubuntu changes", " - [Config] temporarily disable OBJTOOL_WERROR", "" ], "package": "linux", "version": "7.0.0-7.7", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "author": "Paolo Pisati ", "date": "Thu, 12 Mar 2026 10:49:34 +0100" } ], "notes": "linux-riscv-headers-7.1.0-5 version '7.1.0-5.5.2' (source package linux-riscv version '7.1.0-5.5.2') was added. linux-riscv-headers-7.1.0-5 version '7.1.0-5.5.2' has the same source package name, linux-riscv, as removed package linux-headers-7.0.0-14-generic. As such we can use the source package version of the removed package, '7.0.0-14.14.2', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-riscv-tools-7.1.0-5", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": null }, "to_version": { "source_package_name": "linux-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158456, 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 1786013, 2154174, 2152714, 2148866, 2149808, 2148718, 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537, 2147403, 2136820, 2147447, 2144712, 2116144, 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477, 2144865, 2144735, 2142775, 2144652, 2143197, 2139276, 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.2 -proposed tracker (LP: #2158456)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Fix packaging by removing amd64-only linux-lib-rust", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158456 ], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:45:40 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.1 -proposed tracker (LP: #2157018)", "", " * Excessive size of kernel modules on RISC-V - modules unstripped", " (LP: #1964335)", " - SAUCE: scripts/Makefile.modinst discard-locals from modules", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-5.5 ]", "", " * stonking/linux: 7.1.0-5.5 -proposed tracker (LP: #2156849)", " * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260", " renders upside-down (LP: #2155837)", " - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14", " Premium PA14260", " * ov08x40 module mounted upside down on a certain DELL platforms", " (LP: #2146517)", " - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with", " upside down sensors", " - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside", " down sensors", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", " - [Config] updateconfigs after v7.1 rebase", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Sarah Emery ", "date": "Mon, 22 Jun 2026 16:39:05 +0200" }, { "cves": [], "log": [ "", " * Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-4.4 ]", "" ], "package": "linux-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Tue, 16 Jun 2026 10:37:24 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux: 7.1.0-4.4 -proposed tracker (LP: #2154256)", "", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", "", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", "" ], "package": "linux", "version": "7.1.0-4.4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Timo Aaltonen ", "date": "Sat, 06 Jun 2026 14:31:44 +0300" }, { "cves": [], "log": [ "", " * stonking/linux: 7.1.0-1.1 -proposed tracker (LP: #2154256)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue", " (LP: #2154174)", " - SAUCE: selftests/seccomp fix compilation issue for amd64", "", " * Kernel 6.19-rc8 does not include GPIB driver (LP: #2152714)", " - [Config] Enable CONFIG_GPIB for amd64", "", " * Miscellaneous Ubuntu changes", " - Update Changes.md after v7.1-rc4 rebase", " - [packaging] Install gdb scripts again", " - [Config] updateconfigs after v7.1-rc5 rebase", " - [Packaging] templates: Use a for-loop for run-parts", " - [Packaging] Remove dead debian.master/rules.d/x32.mk", " - [Packaging] Remove orphaned debian/v4l2loopback-modules.ignore", " - [Packaging] Remove orphaned debian/zfs-modules.ignore", " - [Packaging] Remove deprecated linux-doc transitional stub", " - [Packaging] Remove dead comment referencing gcc-4.7 in control.stub.in", " - [Packaging] Remove dead comment in ppc64el.mk", " - [Packaging] Remove stale legacy code", " - [Packaging] rules: Drop an obsolete check for do_zstd_ko", " - [Config] toolchain version update", " - [Packaging] update Ubuntu.md", "" ], "package": "linux", "version": "7.1.0-1.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 1786013, 2154174, 2152714 ], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 16:08:55 +0300" }, { "cves": [], "log": [ "", " * Dummy entry.", "" ], "package": "linux", "version": "7.1.0-0.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 09:59:13 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)", "", " * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown", " (LP: #2149808)", " - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes", "", " * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest", " Resolute kernels, breaking Secure Boot systems (LP: #2148718)", " - [packaging] add intel-ipu7 to signature inclusion list", "" ], "package": "linux", "version": "7.0.0-15.15", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148866, 2149808, 2148718 ], "author": "Paolo Pisati ", "date": "Wed, 22 Apr 2026 16:02:19 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)", "", " * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)", " - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471", "", " * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)", " - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", "", " * System doesn't response with mt76 call trace (LP: #2137448)", " - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations", "", " * The second tbt storage plugged on the dock will not be recognized", " (LP: #2139572)", " - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan", "", " * dma-buf filesystem flags fix (LP: #2139656)", " - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem", "", " * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17", " (LP: #2145164)", " - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on", " enumeration failure", "", " * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during", " long HPD pulse (LP: #2143879)", " - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port", " during long HPD pulse", "", " * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)", " - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug", " message", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add support for per-flavour depends", " - [Packaging] Don't hard-code lmm zfs dependency", " - [Config] updateconfigs following v7.0 release", "" ], "package": "linux", "version": "7.0.0-14.14", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537 ], "author": "Paolo Pisati ", "date": "Mon, 13 Apr 2026 10:12:22 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)", "", " * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)", " - SAUCE increase socat timeout in gre_gso.sh", "", " * Canonical Kmod 2025 key rotation (LP: #2147447)", " - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing", " extensible", " - [Packaging] ubuntu-compatible-signing -- allow consumption of positive", " certs", " - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key", " - [Config] prepare for Canonical Kmod key rotation", " - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key", " - [Packaging] ensure our cert rollups are always fresh", "", " * On Dell system, the internal OLED display drops to a visibly low FPS after", " suspend/resume (LP: #2144712)", " - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk", " - drm/i915/psr: Fixes for Dell XPS DA14260 quirk", "", " * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)", " - SAUCE: r8169: add quirk for RTL8116af SerDes", "", " * Miscellaneous Ubuntu changes", " - [Config] updateconfigs following v7.0-rc7 rebase", "" ], "package": "linux", "version": "7.0.0-13.13", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147403, 2136820, 2147447, 2144712, 2116144 ], "author": "Paolo Pisati ", "date": "Wed, 08 Apr 2026 06:56:37 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-12.12 -proposed tracker (LP: #2146778)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * linux-generic does not run scripts in /usr/share/kernel/*.d (LP: #2147005)", " - [Packaging] templates: Use consistent indentation", " - [Packaging] templates: Run scripts in /usr/share/kernel/*.d too", "", " * RISC-V kernel config is out of sync with other archs (LP: #1981437)", " - [Config] riscv64: Enable COUNTER=m", " - [Config] riscv64: Use GENDWARFKSYMS like other architectures", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [30/57]: apparmor-next 7.1: aapparmor: use target", " task's context in apparmor_getprocattr()", " - SAUCE: apparmor5.0.0 [31/57]: apparmor-next 7.1: apparmor: return error", " on namespace mismatch in verify_header", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [34/57]: apparmor-next 7.1: apparmor: Replace", " memcpy + NUL termination with kmemdup_nul in do_setattr", " - SAUCE: apparmor5.0.0 [35/57]: apparmor-next 7.1: apparmor: Remove", " redundant if check in sk_peer_get_label", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [40/57]: apparmor-next 7.1: apparmor: Use", " sysfs_emit in param_get_{audit,mode}", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [46/57]: apparmor-next 7.1: apparmor: Fix string", " overrun due to missing termination", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Enable new Intel WCL soundwire support (LP: #2143301)", " - ASoC: sdw_utils: Add CS42L43B codec info", " - ASoC: dt-bindings: cirrus, cs42l43: Add CS42L43B variant", " - mfd: cs42l43: Add support for the B variant", " - ASoC: cs42l43: Add support for the B variant", "", " * Enable audio functions on Dell Huracan/Renegade platforms w/o built-in", " microphone (LP: #2143902)", " - ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay", " - ASoC: SDCA: Update counting of SU/GE DAPM routes", " - ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes", " - ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops", " - ASoC: add snd_soc_lookup_component_by_name helper", " - ASoC: soc_sdw_utils: partial match the codec name", " - ASoC: soc_sdw_utils: remove index from sdca codec name", "", " * [SRU] MIPI camera is not working after upgrading to 6.17-oem", " (LP: #2145171)", " - SAUCE: ACPI: respect items already in honor_dep before skipping", "", " * linux-tools: consider linking perf against LLVM (LP: #2138328)", " - [Packaging] Actually enable llvm for perf", "", " * Pull patch in qla2xxx to Resolute (LP: #2144856)", " - scsi: qla2xxx: Add support to report MPI FW state", "", " * Ubuntu Resolute Desktop image arm64 - Boot on SC8280XP stalls with gpi-dma", " errors (LP: #2142403)", " - Revert \"arm64: dts: qcom: sc8280xp: Enable GPI DMA\"", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: arm64: dts: add missing denali-oled.dtb to Makefile", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMCC block definition", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa", " and Purwa variants", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device", " tree", " - SAUCE: firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100", " variant", " - SAUCE: arm64: dts: qcom: hamoa: Move PCIe PERST and Wake GPIOs to port", " nodes", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: wip: arm64: dts: qcom: x1e78100-t14s: enable bluetooth", "", " * Miscellaneous Ubuntu changes", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - [Config] PHY_QCOM_MIPI_CSI2=m", " - SAUCE: arm64: dts: x1e80100-lenovo-yoga-slim7x: Fix RGB camera supplies", " - [Config] toolchain version update", " - Update Changes.md after v7.0-rc5 rebase", " - [Packaging] update Ubuntu.md", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Add linux-main-modules-zfs to linux-modules depends", "", " * Miscellaneous upstream changes", " - Revert \"UBUNTU: SAUCE: Add Bluetooth support for the Lenovo Yoga Slim", " 7x\"", "" ], "package": "linux", "version": "7.0.0-12.12", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477 ], "author": "Timo Aaltonen ", "date": "Thu, 02 Apr 2026 11:50:22 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-10.10 -proposed tracker (LP: #2144865)", "", " * Miscellaneous upstream changes", " - Revert \"powerpc: fix KUAP warning in VMX usercopy path\"", "" ], "package": "linux", "version": "7.0.0-10.10", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144865 ], "author": "Paolo Pisati ", "date": "Thu, 19 Mar 2026 09:44:11 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-9.9 -proposed tracker (LP: #2144735)", "", " * Please make dracut the default initrd generator (LP: #2142775)", " - [Packaging] recommends dracut instead of initramfs-tools", "", " * Miscellaneous Ubuntu changes", " - SAUCE: Change RISC-V target to RVA23 (riscv64a23-unknown-linux-gnu)", "" ], "package": "linux", "version": "7.0.0-9.9", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144735, 2142775 ], "author": "Paolo Pisati ", "date": "Wed, 18 Mar 2026 13:11:06 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-8.8 -proposed tracker (LP: #2144652)", "", " * UBUNTU: SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", " (LP: #2143197)", " - SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", "", " * [usrmerge] evaluate kernel owned packages for DEP17 compliance", " (LP: #2139276)", " - [Packaging] Install modules in /usr/lib/modules", "", " * Miscellaneous Ubuntu changes", " - [Config] hardening: enable LIST_HARDENED", " - [Config] hardening: disable LDISC_AUTOLOAD", " - [Config] hardening: disable LEGACY_PTYS", " - [Config] updateconfigs following v7.0-rc4 rebase", "" ], "package": "linux", "version": "7.0.0-8.8", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144652, 2143197, 2139276 ], "author": "Paolo Pisati ", "date": "Tue, 17 Mar 2026 18:01:36 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-7.7 -proposed tracker (LP: #2143974)", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/29]: apparmor: fix fine grained inet mediation", " sock_file_perm", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/29]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/29]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/29]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/29]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/29]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/29]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/29]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/29]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/29]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/29]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/29]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/29]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/29]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/29]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/29]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/29]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/29]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/29]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/29]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/29]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/29]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/29]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/29]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/29]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/29]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/29]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/29]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/29]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * NPU utilization on amdxdna is missing (LP: #2143243)", " - SAUCE: accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate", " - SAUCE: accel/amdxdna: Support sensors for column utilization", " - SAUCE: accel/amdxdna: Import AMD_PMF namespace", "", " * Adopting dark mode by default for OLED panel (LP: #2143203)", " - SAUCE: drm/connector: Add a new 'panel_type' property", " - SAUCE: drm/amd/display: Attach OLED property to eDP panels", "", " * Support AMD Image Signal Processing (ISP) unit V4.0 (LP: #2110092)", " - SAUCE: media: platform: amd: Introduce amd isp4 capture driver", " - SAUCE: media: platform: amd: low level support for isp4 firmware", " - SAUCE: media: platform: amd: Add isp4 fw and hw interface", " - SAUCE: media: platform: amd: isp4 subdev and firmware loading handling", " added", " - SAUCE: media: platform: amd: isp4 video node and buffers handling added", " - SAUCE: Documentation: add documentation of AMD isp 4 driver", " - SAUCE: media: platform: amd: isp4 debug fs logging and more descriptive", " errors", " - [Config] Enable VIDEO_AMD_ISP4_CAPTURE", "", " * Miscellaneous Ubuntu changes", " - [Config] temporarily disable OBJTOOL_WERROR", "" ], "package": "linux", "version": "7.0.0-7.7", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "author": "Paolo Pisati ", "date": "Thu, 12 Mar 2026 10:49:34 +0100" } ], "notes": "linux-riscv-tools-7.1.0-5 version '7.1.0-5.5.2' (source package linux-riscv version '7.1.0-5.5.2') was added. linux-riscv-tools-7.1.0-5 version '7.1.0-5.5.2' has the same source package name, linux-riscv, as removed package linux-headers-7.0.0-14-generic. As such we can use the source package version of the removed package, '7.0.0-14.14.2', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.1.0-5-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": null }, "to_version": { "source_package_name": "linux-riscv", "source_package_version": "7.1.0-5.5.2", "version": "7.1.0-5.5.2" }, "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158456, 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2154256, 1786013, 2154174, 2152714, 2148866, 2149808, 2148718, 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537, 2147403, 2136820, 2147447, 2144712, 2116144, 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477, 2144865, 2144735, 2142775, 2144652, 2143197, 2139276, 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.2 -proposed tracker (LP: #2158456)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Fix packaging by removing amd64-only linux-lib-rust", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158456 ], "author": "Sarah Emery ", "date": "Fri, 26 Jun 2026 17:45:40 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux-riscv: 7.1.0-5.5.1 -proposed tracker (LP: #2157018)", "", " * Excessive size of kernel modules on RISC-V - modules unstripped", " (LP: #1964335)", " - SAUCE: scripts/Makefile.modinst discard-locals from modules", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-5.5 ]", "", " * stonking/linux: 7.1.0-5.5 -proposed tracker (LP: #2156849)", " * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260", " renders upside-down (LP: #2155837)", " - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14", " Premium PA14260", " * ov08x40 module mounted upside down on a certain DELL platforms", " (LP: #2146517)", " - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with", " upside down sensors", " - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside", " down sensors", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", " - [Config] updateconfigs after v7.1 rebase", "" ], "package": "linux-riscv", "version": "7.1.0-5.5.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2157018, 1964335, 2156849, 2155837, 2146517, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Sarah Emery ", "date": "Mon, 22 Jun 2026 16:39:05 +0200" }, { "cves": [], "log": [ "", " * Create linux-riscv sameport", "", " [ Ubuntu: 7.1.0-4.4 ]", "" ], "package": "linux-riscv", "version": "7.1.0-4.4.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Sarah Emery ", "date": "Tue, 16 Jun 2026 10:37:24 +0200" }, { "cves": [ { "cve": "CVE-2026-47337", "url": "https://ubuntu.com/security/CVE-2026-47337", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47334", "url": "https://ubuntu.com/security/CVE-2026-47334", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47333", "url": "https://ubuntu.com/security/CVE-2026-47333", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.", "cve_priority": "high", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47332", "url": "https://ubuntu.com/security/CVE-2026-47332", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in information disclosure from adjacent slab objects.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47330", "url": "https://ubuntu.com/security/CVE-2026-47330", "cve_description": "Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47329", "url": "https://ubuntu.com/security/CVE-2026-47329", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.", "cve_priority": "low", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47327", "url": "https://ubuntu.com/security/CVE-2026-47327", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47328", "url": "https://ubuntu.com/security/CVE-2026-47328", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug can be triggered by an unprivileged local user and can result in the corruption of slab metadata and could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" }, { "cve": "CVE-2026-47326", "url": "https://ubuntu.com/security/CVE-2026-47326", "cve_description": "Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered by an unprivileged local user. The memory leak could lead to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-05-28 19:16:00 UTC" } ], "log": [ "", " * stonking/linux: 7.1.0-4.4 -proposed tracker (LP: #2154256)", "", " * AppArmor Vulnerabilities (LP: #2151747)", " - SAUCE: apparmor: pass big_resp to handler", " - SAUCE: apparmor: remove redundant kref_init for listener->count", " - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337", " - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334", " - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333", " - SAUCE: apparmor: fix dfa unpacking size of the notification filter", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332", " - SAUCE: apparmor: fix size check against type instead of pointer", "", " * apparmor: LLVM/clang build failure due to uninitialized variable in", " notify.c (LP: #2148809) // CVE-2026-47330", " - SAUCE: apparmor: initialize variable used in uninitialized context", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329", " - SAUCE: apparmor: fix name validation bypass on notification", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //", " CVE-2026-47328", " - SAUCE: apparmor: fix glob memory leak after kstrdup", "", " * AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326", " - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Miscellaneous Ubuntu changes", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Fix cross-builds", "" ], "package": "linux", "version": "7.1.0-4.4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 2151747, 2151747, 2151747, 2151747, 2151747, 2148809, 2151747, 2151747, 2151747, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602 ], "author": "Timo Aaltonen ", "date": "Sat, 06 Jun 2026 14:31:44 +0300" }, { "cves": [], "log": [ "", " * stonking/linux: 7.1.0-1.1 -proposed tracker (LP: #2154256)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue", " (LP: #2154174)", " - SAUCE: selftests/seccomp fix compilation issue for amd64", "", " * Kernel 6.19-rc8 does not include GPIB driver (LP: #2152714)", " - [Config] Enable CONFIG_GPIB for amd64", "", " * Miscellaneous Ubuntu changes", " - Update Changes.md after v7.1-rc4 rebase", " - [packaging] Install gdb scripts again", " - [Config] updateconfigs after v7.1-rc5 rebase", " - [Packaging] templates: Use a for-loop for run-parts", " - [Packaging] Remove dead debian.master/rules.d/x32.mk", " - [Packaging] Remove orphaned debian/v4l2loopback-modules.ignore", " - [Packaging] Remove orphaned debian/zfs-modules.ignore", " - [Packaging] Remove deprecated linux-doc transitional stub", " - [Packaging] Remove dead comment referencing gcc-4.7 in control.stub.in", " - [Packaging] Remove dead comment in ppc64el.mk", " - [Packaging] Remove stale legacy code", " - [Packaging] rules: Drop an obsolete check for do_zstd_ko", " - [Config] toolchain version update", " - [Packaging] update Ubuntu.md", "" ], "package": "linux", "version": "7.1.0-1.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2154256, 1786013, 2154174, 2152714 ], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 16:08:55 +0300" }, { "cves": [], "log": [ "", " * Dummy entry.", "" ], "package": "linux", "version": "7.1.0-0.0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Tue, 26 May 2026 09:59:13 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)", "", " * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown", " (LP: #2149808)", " - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes", "", " * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest", " Resolute kernels, breaking Secure Boot systems (LP: #2148718)", " - [packaging] add intel-ipu7 to signature inclusion list", "" ], "package": "linux", "version": "7.0.0-15.15", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148866, 2149808, 2148718 ], "author": "Paolo Pisati ", "date": "Wed, 22 Apr 2026 16:02:19 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)", "", " * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)", " - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471", "", " * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)", " - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", "", " * System doesn't response with mt76 call trace (LP: #2137448)", " - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations", "", " * The second tbt storage plugged on the dock will not be recognized", " (LP: #2139572)", " - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan", "", " * dma-buf filesystem flags fix (LP: #2139656)", " - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem", "", " * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17", " (LP: #2145164)", " - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on", " enumeration failure", "", " * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during", " long HPD pulse (LP: #2143879)", " - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port", " during long HPD pulse", "", " * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)", " - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug", " message", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add support for per-flavour depends", " - [Packaging] Don't hard-code lmm zfs dependency", " - [Config] updateconfigs following v7.0 release", "" ], "package": "linux", "version": "7.0.0-14.14", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2148159, 2138841, 2147533, 2137448, 2139572, 2139656, 2145164, 2143879, 2144537 ], "author": "Paolo Pisati ", "date": "Mon, 13 Apr 2026 10:12:22 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)", "", " * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)", " - SAUCE increase socat timeout in gre_gso.sh", "", " * Canonical Kmod 2025 key rotation (LP: #2147447)", " - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing", " extensible", " - [Packaging] ubuntu-compatible-signing -- allow consumption of positive", " certs", " - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key", " - [Config] prepare for Canonical Kmod key rotation", " - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key", " - [Packaging] ensure our cert rollups are always fresh", "", " * On Dell system, the internal OLED display drops to a visibly low FPS after", " suspend/resume (LP: #2144712)", " - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk", " - drm/i915/psr: Fixes for Dell XPS DA14260 quirk", "", " * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)", " - SAUCE: r8169: add quirk for RTL8116af SerDes", "", " * Miscellaneous Ubuntu changes", " - [Config] updateconfigs following v7.0-rc7 rebase", "" ], "package": "linux", "version": "7.0.0-13.13", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147403, 2136820, 2147447, 2144712, 2116144 ], "author": "Paolo Pisati ", "date": "Wed, 08 Apr 2026 06:56:37 +0200" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-12.12 -proposed tracker (LP: #2146778)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update variants", "", " * linux-generic does not run scripts in /usr/share/kernel/*.d (LP: #2147005)", " - [Packaging] templates: Use consistent indentation", " - [Packaging] templates: Run scripts in /usr/share/kernel/*.d too", "", " * RISC-V kernel config is out of sync with other archs (LP: #1981437)", " - [Config] riscv64: Enable COUNTER=m", " - [Config] riscv64: Use GENDWARFKSYMS like other architectures", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * FFe: add network interface mediation to 26.04 (LP: #2144679)", " - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface", " in network mediation.", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation", " sock_file_perm", " - SAUCE: apparmor5.0.0 [30/57]: apparmor-next 7.1: aapparmor: use target", " task's context in apparmor_getprocattr()", " - SAUCE: apparmor5.0.0 [31/57]: apparmor-next 7.1: apparmor: return error", " on namespace mismatch in verify_header", " - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable", " differential encoding", " - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate", " -ENOMEM correctly in unpack_table", " - SAUCE: apparmor5.0.0 [34/57]: apparmor-next 7.1: apparmor: Replace", " memcpy + NUL termination with kmemdup_nul in do_setattr", " - SAUCE: apparmor5.0.0 [35/57]: apparmor-next 7.1: apparmor: Remove", " redundant if check in sk_peer_get_label", " - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use", " __label_make_stale in __aa_proxy_redirect", " - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and", " policy.h circular include pattern", " - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include", " headers self-contained", " - SAUCE: apparmor5.0.0 [40/57]: apparmor-next 7.1: apparmor: Use", " sysfs_emit in param_get_{audit,mode}", " - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix", " rawdata_f_data implicit flex array", " - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata", " as soon as possible", " - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial", " support for compressed policies", " - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential", " UAF in aa_replace_profiles", " - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused", " get_loaddata_common_ref() function", " - SAUCE: apparmor5.0.0 [46/57]: apparmor-next 7.1: apparmor: Fix string", " overrun due to missing termination", " - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header", " struct", " - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit", " responses.", " - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to", " not return NULL", " - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of", " handling not supported", " - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to", " the LSM network operations", " - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to", " inet_conn_request", " - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation", " binding", " - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation", " - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()", " when !inet and secmark defined.", " - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation", " falures", "", " * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop", " Flatpak doesn't work with the current AppArmor profile (LP: #2142956)", " - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock", " and refresh when looking up changehat child profiles", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/57]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/57]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * Enable new Intel WCL soundwire support (LP: #2143301)", " - ASoC: sdw_utils: Add CS42L43B codec info", " - ASoC: dt-bindings: cirrus, cs42l43: Add CS42L43B variant", " - mfd: cs42l43: Add support for the B variant", " - ASoC: cs42l43: Add support for the B variant", "", " * Enable audio functions on Dell Huracan/Renegade platforms w/o built-in", " microphone (LP: #2143902)", " - ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay", " - ASoC: SDCA: Update counting of SU/GE DAPM routes", " - ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes", " - ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops", " - ASoC: add snd_soc_lookup_component_by_name helper", " - ASoC: soc_sdw_utils: partial match the codec name", " - ASoC: soc_sdw_utils: remove index from sdca codec name", "", " * [SRU] MIPI camera is not working after upgrading to 6.17-oem", " (LP: #2145171)", " - SAUCE: ACPI: respect items already in honor_dep before skipping", "", " * linux-tools: consider linking perf against LLVM (LP: #2138328)", " - [Packaging] Actually enable llvm for perf", "", " * Pull patch in qla2xxx to Resolute (LP: #2144856)", " - scsi: qla2xxx: Add support to report MPI FW state", "", " * Ubuntu Resolute Desktop image arm64 - Boot on SC8280XP stalls with gpi-dma", " errors (LP: #2142403)", " - Revert \"arm64: dts: qcom: sc8280xp: Enable GPI DMA\"", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: arm64: dts: add missing denali-oled.dtb to Makefile", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMCC block definition", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa", " and Purwa variants", " - SAUCE: arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device", " tree", " - SAUCE: firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100", " variant", " - SAUCE: arm64: dts: qcom: hamoa: Move PCIe PERST and Wake GPIOs to port", " nodes", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: wip: arm64: dts: qcom: x1e78100-t14s: enable bluetooth", "", " * Miscellaneous Ubuntu changes", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - [Config] PHY_QCOM_MIPI_CSI2=m", " - SAUCE: arm64: dts: x1e80100-lenovo-yoga-slim7x: Fix RGB camera supplies", " - [Config] toolchain version update", " - Update Changes.md after v7.0-rc5 rebase", " - [Packaging] update Ubuntu.md", " - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED", " - [Packaging] Add linux-main-modules-zfs to linux-modules depends", "", " * Miscellaneous upstream changes", " - Revert \"UBUNTU: SAUCE: Add Bluetooth support for the Lenovo Yoga Slim", " 7x\"", "" ], "package": "linux", "version": "7.0.0-12.12", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2146778, 1786013, 2147005, 1981437, 1990064, 2144679, 2142956, 2139664, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143301, 2143902, 2145171, 2138328, 2144856, 2142403, 2144643, 2121477 ], "author": "Timo Aaltonen ", "date": "Thu, 02 Apr 2026 11:50:22 +0300" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-10.10 -proposed tracker (LP: #2144865)", "", " * Miscellaneous upstream changes", " - Revert \"powerpc: fix KUAP warning in VMX usercopy path\"", "" ], "package": "linux", "version": "7.0.0-10.10", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144865 ], "author": "Paolo Pisati ", "date": "Thu, 19 Mar 2026 09:44:11 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-9.9 -proposed tracker (LP: #2144735)", "", " * Please make dracut the default initrd generator (LP: #2142775)", " - [Packaging] recommends dracut instead of initramfs-tools", "", " * Miscellaneous Ubuntu changes", " - SAUCE: Change RISC-V target to RVA23 (riscv64a23-unknown-linux-gnu)", "" ], "package": "linux", "version": "7.0.0-9.9", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144735, 2142775 ], "author": "Paolo Pisati ", "date": "Wed, 18 Mar 2026 13:11:06 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-8.8 -proposed tracker (LP: #2144652)", "", " * UBUNTU: SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", " (LP: #2143197)", " - SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms", "", " * [usrmerge] evaluate kernel owned packages for DEP17 compliance", " (LP: #2139276)", " - [Packaging] Install modules in /usr/lib/modules", "", " * Miscellaneous Ubuntu changes", " - [Config] hardening: enable LIST_HARDENED", " - [Config] hardening: disable LDISC_AUTOLOAD", " - [Config] hardening: disable LEGACY_PTYS", " - [Config] updateconfigs following v7.0-rc4 rebase", "" ], "package": "linux", "version": "7.0.0-8.8", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2144652, 2143197, 2139276 ], "author": "Paolo Pisati ", "date": "Tue, 17 Mar 2026 18:01:36 +0100" }, { "cves": [], "log": [ "", " * resolute/linux: 7.0.0-7.7 -proposed tracker (LP: #2143974)", "", " * unconfined profile denies userns_create for chromium based processes", " (LP: #1990064)", " - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS", "", " * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile", " (LP: #2142956)", " - SAUCE: apparmor5.0.0 [29/29]: apparmor: fix fine grained inet mediation", " sock_file_perm", "", " * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)", " - SAUCE: apparmor5.0.0 [28/29]: apparmor: fix aa_label_sk_perm to check", " for RULE_MEDIATES_NET", "", " * update apparmor and LSM stacking patch set (LP: #2028253)", " - SAUCE: apparmor5.0.0 [1/29]: Stacking: LSM: Single calls in secid hooks", " - SAUCE: apparmor5.0.0 [2/29]: Stacking: LSM: Exclusive secmark usage", " - SAUCE: apparmor5.0.0 [3/29]: Stacking: AppArmor: Remove the exclusive", " flag", " - SAUCE: apparmor5.0.0 [4/29]: Revert \"apparmor: fix dbus permission", " queries to v9 ABI\"", " - SAUCE: apparmor5.0.0 [5/29]: Revert \"apparmor: gate make fine grained", " unix mediation behind v9 abi\"", " - SAUCE: apparmor5.0.0 [6/29]: apparmor: net: patch to provide", " compatibility with v2.x net rules", " - SAUCE: apparmor5.0.0 [7/29]: apparmor: net: add fine grained ipv4/ipv6", " mediation", " - SAUCE: apparmor5.0.0 [8/29]: apparmor: lift compatibility check out of", " profile_af_perm", " - SAUCE: apparmor5.0.0 [9/29]: apparmor: userns: add unprivileged user ns", " mediation", " - SAUCE: apparmor5.0.0 [10/29]: apparmor: userns: Add sysctls for", " additional controls of unpriv userns restrictions", " - SAUCE: apparmor5.0.0 [12/29]: apparmor: userns: open userns related", " sysctl so lxc can check if restriction are in place", " - SAUCE: apparmor5.0.0 [13/29]: apparmor: userns: allow profile to be", " transitioned when a userns is created", " - SAUCE: apparmor5.0.0 [14/29]: apparmor: mqueue: call", " security_inode_init_security on inode creation", " - SAUCE: apparmor5.0.0 [15/29]: apparmor: mqueue: add fine grained", " mediation of posix mqueues", " - SAUCE: apparmor5.0.0 [16/29]: apparmor: uring: add io_uring mediation", " - SAUCE: apparmor5.0.0 [19/29]: apparmor: prompt: setup slab cache for", " audit data", " - SAUCE: apparmor5.0.0 [20/29]: apparmor: prompt: add the ability for", " profiles to have a learning cache", " - SAUCE: apparmor5.0.0 [21/29]: apparmor: prompt: enable userspace upcall", " for mediation", " - SAUCE: apparmor5.0.0 [22/29]: apparmor: prompt: pass prompt boolean", " through into path_name as well", " - SAUCE: apparmor5.0.0 [23/29]: apparmor: check for supported version in", " notification messages.", " - SAUCE: apparmor5.0.0 [24/29]: apparmor: refactor building notice so it", " is easier to extend", " - SAUCE: apparmor5.0.0 [25/29]: apparmor: switch from ENOTSUPP to", " EPROTONOSUPPORT", " - SAUCE: apparmor5.0.0 [26/29]: apparmor: add support for meta data tags", " - SAUCE: apparmor5.0.0 [27/29]: apparmor: prevent profile->disconnected", " double free in aa_free_profile", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // Installation", " of AppArmor on a 6.14 kernel produces error message \"Illegal number: yes\"", " (LP: #2102680)", " - SAUCE: apparmor5.0.0 [17/29]: apparmor: create an", " AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant", " - SAUCE: apparmor5.0.0 [18/29]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT", " for userns and io_uring sysctls", "", " * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]", " apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in", " mantic (LP: #2032602)", " - SAUCE: apparmor5.0.0 [11/29]: apparmor: userns - make it so special", " unconfined profiles can mediate user namespaces", "", " * NPU utilization on amdxdna is missing (LP: #2143243)", " - SAUCE: accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate", " - SAUCE: accel/amdxdna: Support sensors for column utilization", " - SAUCE: accel/amdxdna: Import AMD_PMF namespace", "", " * Adopting dark mode by default for OLED panel (LP: #2143203)", " - SAUCE: drm/connector: Add a new 'panel_type' property", " - SAUCE: drm/amd/display: Attach OLED property to eDP panels", "", " * Support AMD Image Signal Processing (ISP) unit V4.0 (LP: #2110092)", " - SAUCE: media: platform: amd: Introduce amd isp4 capture driver", " - SAUCE: media: platform: amd: low level support for isp4 firmware", " - SAUCE: media: platform: amd: Add isp4 fw and hw interface", " - SAUCE: media: platform: amd: isp4 subdev and firmware loading handling", " added", " - SAUCE: media: platform: amd: isp4 video node and buffers handling added", " - SAUCE: Documentation: add documentation of AMD isp 4 driver", " - SAUCE: media: platform: amd: isp4 debug fs logging and more descriptive", " errors", " - [Config] Enable VIDEO_AMD_ISP4_CAPTURE", "", " * Miscellaneous Ubuntu changes", " - [Config] temporarily disable OBJTOOL_WERROR", "" ], "package": "linux", "version": "7.0.0-7.7", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143974, 1990064, 2142956, 2141298, 2028253, 2028253, 2102680, 2028253, 2032602, 2143243, 2143203, 2110092 ], "author": "Paolo Pisati ", "date": "Thu, 12 Mar 2026 10:49:34 +0100" } ], "notes": "linux-tools-7.1.0-5-generic version '7.1.0-5.5.2' (source package linux-riscv version '7.1.0-5.5.2') was added. linux-tools-7.1.0-5-generic version '7.1.0-5.5.2' has the same source package name, linux-riscv, as removed package linux-headers-7.0.0-14-generic. As such we can use the source package version of the removed package, '7.0.0-14.14.2', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "libflashrom1:riscv64", "from_version": { "source_package_name": "flashrom", "source_package_version": "1.6.0-2ubuntu1", "version": "1.6.0-2ubuntu1" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "libftdi1-2:riscv64", "from_version": { "source_package_name": "libftdi1", "source_package_version": "1.6~rc1-1build1", "version": "1.6~rc1-1build1" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "libjcat1:riscv64", "from_version": { "source_package_name": "libjcat", "source_package_version": "0.2.5-1build1", "version": "0.2.5-1build1" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "libjson-glib-1.0-0:riscv64", "from_version": { "source_package_name": "json-glib", "source_package_version": "1.10.8+ds-2", "version": "1.10.8+ds-2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "libjson-glib-1.0-common", "from_version": { "source_package_name": "json-glib", "source_package_version": "1.10.8+ds-2", "version": "1.10.8+ds-2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "librtmp1:riscv64", "from_version": { "source_package_name": "rtmpdump", "source_package_version": "2.6-1", "version": "2.6-1" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-7.0.0-14-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-7.0.0-14-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.0.0-14-generic", "from_version": { "source_package_name": "linux-main-signed-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-14-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-riscv-headers-7.0.0-14", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-riscv-tools-7.0.0-14", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.0.0-14-generic", "from_version": { "source_package_name": "linux-riscv", "source_package_version": "7.0.0-14.14.2", "version": "7.0.0-14.14.2" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.10 stonking image from daily image serial 20260627 to 20260726", "from_series": "stonking", "to_series": "stonking", "from_serial": "20260627", "to_serial": "20260726", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }