{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "curl", "libaudit-common", "libaudit1", "libcurl4", "libexpat1", "libisns0" ] } }, "diff": { "deb": [ { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.27", "version": "7.81.0-1ubuntu1.27" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " [ Charles Cocharn ]", " * SECURITY UPDATE: Use after free in HTTP/2 server push.", " - debian/patches/CVE-2026-18924.patch: make server push transfers", " inherit share from parent in lib/http2.c.", " - CVE-2026-18924", " * SECURITY UPDATE: Public key pinning bypass.", " - debian/patches/CVE-2026-80230.patch: require server cert if public", " key pinned in lib/vtls/openssl.c.", " - CVE-2026-80230", " * SECURITY UPDATE: Cookie injection for public suffix domains.", " - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact", " PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,", " tests/data/test1136, tests/data/test2318.", " - CVE-2026-82209", "", " [ Kyle Kernick ]", " * SECURITY REGRESSION: checksrc errors and failing test case for", " CVE-2026-8927 (LP #2167779)", " - debian/patches/CVE-2026-6429.patch: Fix indentation to fix", " autopkgtests in lib/transfer.c.", " - debian/patches/CVE-2026-8458.patch: Wrap long lines and fix", " indentation to fix autopkgtests in lib/curl_sasl.c.", " - debian/patches/CVE-2026-8932.patch: Wrap long lines to fix", " autopkgtests in lib/url.c, lib/vtls/nss.c, and lib/vtls/openssl.c.", " - debian/patches/CVE-2026-8927.patch: Fix failing test", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.29", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Fri, 18 Sep 2026 11:47:53 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libaudit-common", "from_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1build1", "version": "1:3.0.7-1build1" }, "to_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1ubuntu0.1", "version": "1:3.0.7-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 1117804 ], "changes": [ { "cves": [], "log": [ "", " * Fix AppArmor AVC events not appearing in `ausearch` (LP: #1117804)", " - d/p/lp1117804-audit-ausearch-do-not-require-tclass.patch", "" ], "package": "audit", "version": "1:3.0.7-1ubuntu0.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1117804 ], "author": "Alex Ramírez ", "date": "Tue, 14 Jul 2026 17:13:46 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libaudit1", "from_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1build1", "version": "1:3.0.7-1build1" }, "to_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1ubuntu0.1", "version": "1:3.0.7-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 1117804 ], "changes": [ { "cves": [], "log": [ "", " * Fix AppArmor AVC events not appearing in `ausearch` (LP: #1117804)", " - d/p/lp1117804-audit-ausearch-do-not-require-tclass.patch", "" ], "package": "audit", "version": "1:3.0.7-1ubuntu0.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1117804 ], "author": "Alex Ramírez ", "date": "Tue, 14 Jul 2026 17:13:46 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.27", "version": "7.81.0-1ubuntu1.27" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " [ Charles Cocharn ]", " * SECURITY UPDATE: Use after free in HTTP/2 server push.", " - debian/patches/CVE-2026-18924.patch: make server push transfers", " inherit share from parent in lib/http2.c.", " - CVE-2026-18924", " * SECURITY UPDATE: Public key pinning bypass.", " - debian/patches/CVE-2026-80230.patch: require server cert if public", " key pinned in lib/vtls/openssl.c.", " - CVE-2026-80230", " * SECURITY UPDATE: Cookie injection for public suffix domains.", " - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact", " PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,", " tests/data/test1136, tests/data/test2318.", " - CVE-2026-82209", "", " [ Kyle Kernick ]", " * SECURITY REGRESSION: checksrc errors and failing test case for", " CVE-2026-8927 (LP #2167779)", " - debian/patches/CVE-2026-6429.patch: Fix indentation to fix", " autopkgtests in lib/transfer.c.", " - debian/patches/CVE-2026-8458.patch: Wrap long lines and fix", " indentation to fix autopkgtests in lib/curl_sasl.c.", " - debian/patches/CVE-2026-8932.patch: Wrap long lines to fix", " autopkgtests in lib/url.c, lib/vtls/nss.c, and lib/vtls/openssl.c.", " - debian/patches/CVE-2026-8927.patch: Fix failing test", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.29", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Fri, 18 Sep 2026 11:47:53 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libexpat1", "from_version": { "source_package_name": "expat", "source_package_version": "2.4.7-1ubuntu0.8", "version": "2.4.7-1ubuntu0.8" }, "to_version": { "source_package_name": "expat", "source_package_version": "2.4.7-1ubuntu0.9", "version": "2.4.7-1ubuntu0.9" }, "cves": [ { "cve": "CVE-2026-56410", "url": "https://ubuntu.com/security/CVE-2026-56410", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56406", "url": "https://ubuntu.com/security/CVE-2026-56406", "cve_description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56409", "url": "https://ubuntu.com/security/CVE-2026-56409", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56407", "url": "https://ubuntu.com/security/CVE-2026-56407", "cve_description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56411", "url": "https://ubuntu.com/security/CVE-2026-56411", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.", "cve_priority": "medium", "cve_public_date": "2026-06-21 17:16:00 UTC" }, { "cve": "CVE-2026-56131", "url": "https://ubuntu.com/security/CVE-2026-56131", "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-56132", "url": "https://ubuntu.com/security/CVE-2026-56132", "cve_description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-72522", "url": "https://ubuntu.com/security/CVE-2026-72522", "cve_description": "libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.", "cve_priority": "medium", "cve_public_date": "2026-08-10 04:16:00 UTC" }, { "cve": "CVE-2026-66046", "url": "https://ubuntu.com/security/CVE-2026-66046", "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "cve_priority": "medium", "cve_public_date": "2026-08-18 15:16:00 UTC" }, { "cve": "CVE-2026-76641", "url": "https://ubuntu.com/security/CVE-2026-76641", "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-76957", "url": "https://ubuntu.com/security/CVE-2026-76957", "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-56410", "url": "https://ubuntu.com/security/CVE-2026-56410", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56406", "url": "https://ubuntu.com/security/CVE-2026-56406", "cve_description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56409", "url": "https://ubuntu.com/security/CVE-2026-56409", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56407", "url": "https://ubuntu.com/security/CVE-2026-56407", "cve_description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56411", "url": "https://ubuntu.com/security/CVE-2026-56411", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.", "cve_priority": "medium", "cve_public_date": "2026-06-21 17:16:00 UTC" }, { "cve": "CVE-2026-56131", "url": "https://ubuntu.com/security/CVE-2026-56131", "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-56132", "url": "https://ubuntu.com/security/CVE-2026-56132", "cve_description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-72522", "url": "https://ubuntu.com/security/CVE-2026-72522", "cve_description": "libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.", "cve_priority": "medium", "cve_public_date": "2026-08-10 04:16:00 UTC" }, { "cve": "CVE-2026-66046", "url": "https://ubuntu.com/security/CVE-2026-66046", "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "cve_priority": "medium", "cve_public_date": "2026-08-18 15:16:00 UTC" }, { "cve": "CVE-2026-76641", "url": "https://ubuntu.com/security/CVE-2026-76641", "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-76957", "url": "https://ubuntu.com/security/CVE-2026-76957", "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56410-1.patch: xmlwf: protect resolveSystemId from", " integer overflow in expat/xmlwf/xmlfile.c.", " - debian/patches/CVE-2026-56410-2.patch: xmlwf: guard each operator in", " resolveSystemId length sum in expat/xmlwf/xmlfile.c.", " - CVE-2026-56410", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56406.patch: lib: Copy overflow check from", " `XML_Parse` to `XML_ParseBuffer` in expat/lib/xmlparse.c.", " - CVE-2026-56406", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56409.patch: xmlwf: protect output path join from", " integer overflow in expat/xmlwf/xmlwf.c.", " - CVE-2026-56409", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56407.patch: cap entity textLen against signed", " integer overflow in expat/lib/xmlparse.c.", " - CVE-2026-56407", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56411.patch: xmlwf: protect notation list", " allocation from integer overflow in expat/xmlwf/xmlwf.c.", " - CVE-2026-56411", " * SECURITY UPDATE: use after free", " - debian/patches/CVE-2026-56131.patch: lib: protect XML_ResumeParser from", " being called from a handler in expat/lib/xmlparse.c,", " expat/tests/runtests.c.", " - CVE-2026-56131", " * SECURITY UPDATE: heap-based buffer overflow", " - debian/patches/CVE-2026-56132-pre1.patch: lib: swap '(size_t)(-1)' for C99", " equivalent, 'SIZE_MAX' in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-pre2.patch: lib: use a `size_t` for group", " sizes in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-1.patch: lib: Remove reuse of `m_groupSize`", " to count `m_scaffIndex` allocation in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-2.patch: lib: doProlog: Fix out-of-bound", " scaffolding index store in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-3.patch: tests: Add a test case for", " scaffolding array limits in shared DTDs in expat/tests/runtests.c.", " - debian/patches/CVE-2026-56132-4.patch: lib: Remove unnecessary", " `scaffIndex` expansion in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-5.patch: lib: Remove indented scoping of", " `new_connector` local in expat/lib/xmlparse.c.", " - CVE-2026-56132", " * SECURITY UPDATE: out-of-bounds read", " - debian/patches/CVE-2026-72522-1.patch: lib: Improve in-code comment for", " functions *toUtf16 in expat/lib/xmltok.c.", " - debian/patches/CVE-2026-72522-2.patch: lib: Stop functions *_toUtf16 from", " mis-classifying low surrogates as high surrogates in expat/lib/xmltok.c.", " - debian/patches/CVE-2026-72522-3.patch: tests/misc_tests.c: Cover Unicode", " surrogate mix-up in expat/tests/runtests.c.", " - debian/patches/CVE-2026-72522-4.patch: lib: Make an exit condition in", " `storeAttributeValue` more defensive in expat/lib/xmlparse.c.", " - CVE-2026-72522", " * SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())", " - debian/patches/CVE-2026-66046.patch: - lib: Rename hash table `defaultAttsNames` to", " `defaultAttForName` in expat/lib/xmlparse.c. - lib: Migrate .isCdata", " lookup from a linear loop to a hash table lookup in", " expat/lib/xmlparse.c", " - CVE-2026-66046", " * SECURITY UPDATE: out-of-bounds read", " - debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash", " table entries created by dtdCopy in expat/lib/xmlparse.c,", " expat/tests/runtests.c.", " - CVE-2026-76641", " * SECURITY UPDATE: use after free", " - debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks", " from parser reentry in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback", " reentry protection in expat/tests/runtests.c.", " - CVE-2026-76957", "" ], "package": "expat", "version": "2.4.7-1ubuntu0.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Tue, 22 Sep 2026 08:18:50 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libisns0", "from_version": { "source_package_name": "open-isns", "source_package_version": "0.101-0ubuntu2", "version": "0.101-0ubuntu2" }, "to_version": { "source_package_name": "open-isns", "source_package_version": "0.101-0ubuntu2.1", "version": "0.101-0ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-55995", "url": "https://ubuntu.com/security/CVE-2026-55995", "cve_description": "A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.", "cve_priority": "medium", "cve_public_date": "2026-07-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-55995", "url": "https://ubuntu.com/security/CVE-2026-55995", "cve_description": "A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.", "cve_priority": "medium", "cve_public_date": "2026-07-29 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Fix double-free in malformed attribute error handling.", " - debian/patches/CVE-2026-55995.patch: Fix issue in error path causing", " double-free. in attrs.c.", " - CVE-2026-55995", "" ], "package": "open-isns", "version": "0.101-0ubuntu2.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Tue, 22 Sep 2026 13:19:37 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20260922 to 20260924", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260922", "to_serial": "20260924", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }