{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "base-files", "gir1.2-glib-2.0", "libc-bin", "libc6", "libexpat1", "libglib2.0-0t64", "libgssapi-krb5-2", "libk5crypto3", "libkrb5-3", "libkrb5support0", "libnetplan1", "libpython3.12-minimal", "libpython3.12-stdlib", "libsqlite3-0", "netplan-generator", "netplan.io", "perl-base", "python-apt-common", "python3-apt", "python3-distupgrade", "python3-netplan", "python3.12", "python3.12-minimal", "ubuntu-release-upgrader-core" ] } }, "diff": { "deb": [ { "name": "base-files", "from_version": { "source_package_name": "base-files", "source_package_version": "13ubuntu10.4", "version": "13ubuntu10.4" }, "to_version": { "source_package_name": "base-files", "source_package_version": "13ubuntu10.5", "version": "13ubuntu10.5" }, "cves": [], "launchpad_bugs_fixed": [ 2166604 ], "changes": [ { "cves": [], "log": [ "", " * /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 24.04.5", " (LP: #2166604)", "" ], "package": "base-files", "version": "13ubuntu10.5", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2166604 ], "author": "Graham Inggs ", "date": "Sun, 06 Sep 2026 14:29:43 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "gir1.2-glib-2.0", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.8", "version": "2.80.0-6ubuntu3.8" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.9", "version": "2.80.0-6ubuntu3.9" }, "cves": [ { "cve": "CVE-2026-58010", "url": "https://ubuntu.com/security/CVE-2026-58010", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58011", "url": "https://ubuntu.com/security/CVE-2026-58011", "cve_description": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58012", "url": "https://ubuntu.com/security/CVE-2026-58012", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58013", "url": "https://ubuntu.com/security/CVE-2026-58013", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58014", "url": "https://ubuntu.com/security/CVE-2026-58014", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58015", "url": "https://ubuntu.com/security/CVE-2026-58015", "cve_description": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58016", "url": "https://ubuntu.com/security/CVE-2026-58016", "cve_description": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-15588", "url": "https://ubuntu.com/security/CVE-2026-15588", "cve_description": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.", "cve_priority": "medium", "cve_public_date": "2026-07-20 12:17:00 UTC" }, { "cve": "CVE-2026-16118", "url": "https://ubuntu.com/security/CVE-2026-16118", "cve_description": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.", "cve_priority": "medium", "cve_public_date": "2026-07-17 20:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-58010", "url": "https://ubuntu.com/security/CVE-2026-58010", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58011", "url": "https://ubuntu.com/security/CVE-2026-58011", "cve_description": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58012", "url": "https://ubuntu.com/security/CVE-2026-58012", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58013", "url": "https://ubuntu.com/security/CVE-2026-58013", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58014", "url": "https://ubuntu.com/security/CVE-2026-58014", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58015", "url": "https://ubuntu.com/security/CVE-2026-58015", "cve_description": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58016", "url": "https://ubuntu.com/security/CVE-2026-58016", "cve_description": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-15588", "url": "https://ubuntu.com/security/CVE-2026-15588", "cve_description": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.", "cve_priority": "medium", "cve_public_date": "2026-07-20 12:17:00 UTC" }, { "cve": "CVE-2026-16118", "url": "https://ubuntu.com/security/CVE-2026-16118", "cve_description": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.", "cve_priority": "medium", "cve_public_date": "2026-07-17 20:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: off-by-one OOB read in GVariant serialiser", " - debian/patches/CVE-2026-58010.patch: fix bounds check to use >= instead", " of > in gvs_tuple_is_normal() in glib/gvariant-serialiser.c.", " - CVE-2026-58010", " * SECURITY UPDATE: OOB read in GDateTime", " - debian/patches/CVE-2026-58011.patch: add missing range validation to", " g_date_time_add_full() in glib/gdatetime.c.", " - CVE-2026-58011", " * SECURITY UPDATE: buffer over-read in g_regex_replace", " - debian/patches/CVE-2026-58012.patch: fix case-change substitution", " handling with G_REGEX_RAW in glib/gregex.c.", " - CVE-2026-58012", " * SECURITY UPDATE: buffer over-read in GIOChannel", " - debian/patches/CVE-2026-58013.patch: add length check before memcmp", " in g_io_channel_read_line_backend() in glib/giochannel.c.", " - CVE-2026-58013", " * SECURITY UPDATE: off-by-one heap under-read in GKeyFile", " - debian/patches/CVE-2026-58014.patch: add len > 0 check before", " accessing value[len-1] in g_key_file_get_locale_string_list() in", " glib/gkeyfile.c.", " - CVE-2026-58014", " * SECURITY UPDATE: path traversal in DBUS_COOKIE_SHA1 auth", " - debian/patches/CVE-2026-58015.patch: validate cookie_context parameter", " to prevent path traversal in gio/gdbusauthmechanismsha1.c.", " - CVE-2026-58015", " * SECURITY UPDATE: state confusion in D-Bus introspection XML parser", " - debian/patches/CVE-2026-58016.patch: fix node element nesting check", " and add assertions in gio/gdbusintrospection.c.", " - CVE-2026-58016", " * SECURITY UPDATE: resource exhaustion in GDBus authentication", " - debian/patches/CVE-2026-15588.patch: limit length of lines read from", " client in gio/gdbusauth.c.", " - CVE-2026-15588", " * SECURITY UPDATE: heap buffer overflow in xdgmime", " - debian/patches/CVE-2026-16118.patch: fix pointer arithmetic in", " byte-swap routine in gio/xdgmime/xdgmimemagic.c.", " - CVE-2026-16118", "" ], "package": "glib2.0", "version": "2.80.0-6ubuntu3.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Tue, 08 Sep 2026 14:07:47 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libexpat1", "from_version": { "source_package_name": "expat", "source_package_version": "2.6.1-2ubuntu0.4", "version": "2.6.1-2ubuntu0.4" }, "to_version": { "source_package_name": "expat", "source_package_version": "2.6.1-2ubuntu0.5", "version": "2.6.1-2ubuntu0.5" }, "cves": [ { "cve": "CVE-2025-59375", "url": "https://ubuntu.com/security/CVE-2025-59375", "cve_description": "libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.", "cve_priority": "medium", "cve_public_date": "2025-09-15 03:15:00 UTC" }, { "cve": "CVE-2026-32776", "url": "https://ubuntu.com/security/CVE-2026-32776", "cve_description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.", "cve_priority": "medium", "cve_public_date": "2026-03-16 14:19:00 UTC" }, { "cve": "CVE-2026-32777", "url": "https://ubuntu.com/security/CVE-2026-32777", "cve_description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.", "cve_priority": "medium", "cve_public_date": "2026-03-16 14:19:00 UTC" }, { "cve": "CVE-2026-32778", "url": "https://ubuntu.com/security/CVE-2026-32778", "cve_description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.", "cve_priority": "medium", "cve_public_date": "2026-03-16 14:19:00 UTC" }, { "cve": "CVE-2026-45186", "url": "https://ubuntu.com/security/CVE-2026-45186", "cve_description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.", "cve_priority": "medium", "cve_public_date": "2026-05-10 07:16:00 UTC" }, { "cve": "CVE-2026-41080", "url": "https://ubuntu.com/security/CVE-2026-41080", "cve_description": "libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.", "cve_priority": "medium", "cve_public_date": "2026-04-16 17:16:00 UTC" }, { "cve": "CVE-2026-56408", "url": "https://ubuntu.com/security/CVE-2026-56408", "cve_description": "libexpat before 2.8.2 has an integer overflow in copyString.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56403", "url": "https://ubuntu.com/security/CVE-2026-56403", "cve_description": "libexpat before 2.8.2 has an integer overflow in storeAtts.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-50219", "url": "https://ubuntu.com/security/CVE-2026-50219", "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,", "cve_priority": "medium", "cve_public_date": "2026-06-04 06:16:00 UTC" }, { "cve": "CVE-2026-56412", "url": "https://ubuntu.com/security/CVE-2026-56412", "cve_description": "libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.", "cve_priority": "medium", "cve_public_date": "2026-06-21 17:16:00 UTC" }, { "cve": "CVE-2026-56404", "url": "https://ubuntu.com/security/CVE-2026-56404", "cve_description": "libexpat before 2.8.2 has an integer overflow in addBinding.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56405", "url": "https://ubuntu.com/security/CVE-2026-56405", "cve_description": "libexpat before 2.8.2 has an integer overflow in getAttributeId.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-59375", "url": "https://ubuntu.com/security/CVE-2025-59375", "cve_description": "libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.", "cve_priority": "medium", "cve_public_date": "2025-09-15 03:15:00 UTC" }, { "cve": "CVE-2026-32776", "url": "https://ubuntu.com/security/CVE-2026-32776", "cve_description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.", "cve_priority": "medium", "cve_public_date": "2026-03-16 14:19:00 UTC" }, { "cve": "CVE-2026-32777", "url": "https://ubuntu.com/security/CVE-2026-32777", "cve_description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.", "cve_priority": "medium", "cve_public_date": "2026-03-16 14:19:00 UTC" }, { "cve": "CVE-2026-32778", "url": "https://ubuntu.com/security/CVE-2026-32778", "cve_description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.", "cve_priority": "medium", "cve_public_date": "2026-03-16 14:19:00 UTC" }, { "cve": "CVE-2026-45186", "url": "https://ubuntu.com/security/CVE-2026-45186", "cve_description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.", "cve_priority": "medium", "cve_public_date": "2026-05-10 07:16:00 UTC" }, { "cve": "CVE-2026-41080", "url": "https://ubuntu.com/security/CVE-2026-41080", "cve_description": "libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.", "cve_priority": "medium", "cve_public_date": "2026-04-16 17:16:00 UTC" }, { "cve": "CVE-2026-56408", "url": "https://ubuntu.com/security/CVE-2026-56408", "cve_description": "libexpat before 2.8.2 has an integer overflow in copyString.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56403", "url": "https://ubuntu.com/security/CVE-2026-56403", "cve_description": "libexpat before 2.8.2 has an integer overflow in storeAtts.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-50219", "url": "https://ubuntu.com/security/CVE-2026-50219", "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,", "cve_priority": "medium", "cve_public_date": "2026-06-04 06:16:00 UTC" }, { "cve": "CVE-2026-56412", "url": "https://ubuntu.com/security/CVE-2026-56412", "cve_description": "libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.", "cve_priority": "medium", "cve_public_date": "2026-06-21 17:16:00 UTC" }, { "cve": "CVE-2026-56404", "url": "https://ubuntu.com/security/CVE-2026-56404", "cve_description": "libexpat before 2.8.2 has an integer overflow in addBinding.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56405", "url": "https://ubuntu.com/security/CVE-2026-56405", "cve_description": "libexpat before 2.8.2 has an integer overflow in getAttributeId.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: large dynamic memory allocations via a small document", " - debian/patches/CVE-2025-59375-1.patch: lib: Make function dtdCreate use", " macro MALLOC in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-2.patch: lib: Make string pools use macros", " MALLOC, FREE, REALLOC in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-3.patch: lib: Make function hash tables use", " macros MALLOC and FREE in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-4.patch: lib: Make function copyString use", " macro MALLOC in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-5.patch: lib: Make function dtdReset use", " macro FREE in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-6.patch: lib: Make function dtdDestroy use", " macro FREE in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-7.patch: lib: Make function dtdCopy use", " macro MALLOC in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-8.patch: lib: Implement tracking of dynamic", " memory allocations in .github/workflows/data/exported-symbols.txt,", " expat/lib/expat.h, expat/lib/internal.h, expat/lib/libexpat.def.cmake,", " expat/lib/xmlparse.c, expat/tests/basic_tests.c,", " expat/tests/nsalloc_tests.c, expat/xmlwf/xmlwf.c,", " expat/xmlwf/xmlwf_helpgen.py.", " - debian/patches/CVE-2025-59375-9.patch: lib: Make XML_MemFree and", " XML_FreeContentModel match their siblings in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-10.patch: lib: Exclude XML_Mem* functions", " from allocation tracking in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-11.patch: lib: Exclude the main input buffer", " from allocation tracking in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-12.patch: lib: Exclude the content model", " from allocation tracking in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-13.patch: tests: Cover allocation tracking", " and limiting with tests in expat/lib/internal.h, expat/lib/xmlparse.c,", " expat/tests/alloc_tests.c.", " - debian/patches/CVE-2025-59375-14.patch: xmlwf: Wire allocation tracker", " config to existing arguments -a and -b in expat/doc/xmlwf.xml,", " expat/xmlwf/xmlwf.c, expat/xmlwf/xmlwf_helpgen.py.", " - debian/patches/CVE-2025-59375-15.patch: fuzz: Be robust towards NULL", " return from XML_ExternalEntityParserCreate in", " expat/fuzz/xml_parse_fuzzer.c, expat/fuzz/xml_parsebuffer_fuzzer.c.", " - debian/patches/CVE-2025-59375-16.patch: lib: Document and regression-proof", " absence of integer overflow from expat_realloc in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-17.patch: lib: Fix alignment of internal", " allocations for some non-amd64 architectures in expat/lib/internal.h,", " expat/lib/xmlparse.c, expat/tests/alloc_tests.c.", " - debian/patches/CVE-2025-59375-18.patch: tests: Fix test guard for test", " related to allocation tracking in expat/tests/alloc_tests.c.", " - debian/patches/CVE-2025-59375-19.patch: tests: Add new test", " test_alloc_tracker_pointer_alignment in expat/tests/alloc_tests.c.", " - debian/patches/CVE-2025-59375-20.patch: lib: Fix detection of asynchronous", " tags in entities in expat/lib/xmlparse.c.", " - debian/patches/CVE-2025-59375-21.patch: tests: Cover", " XML_ERROR_ASYNC_ENTITY cases in expat/tests/misc_tests.c.", " - debian/patches/CVE-2025-59375-22.patch: tests: Add line/column checks to", " async entity tests in expat/tests/misc_tests.c.", " - CVE-2025-59375", " * SECURITY UPDATE: NULL function-pointer dereference", " - debian/patches/CVE-2026-32776.patch: Fix NULL function-pointer dereference", " for empty external parameter entities in expat/lib/xmlparse.c,", " expat/tests/basic_tests.c.", " - CVE-2026-32776", " * SECURITY UPDATE: infinite loop while parsing DTD content", " - debian/patches/CVE-2026-32777-1.patch: lib: Reject XML_TOK_INSTANCE_START", " infinite loop in entityValueProcessor in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-32777-2.patch: misc_tests.c: Cover", " XML_TOK_INSTANCE_START infinite loop case in expat/tests/misc_tests.c.", " - CVE-2026-32777", " * SECURITY UPDATE: NULL pointer dereference", " - debian/patches/CVE-2026-32778-1.patch: copy prefix name to pool before", " lookup in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-32778-2.patch: test that we do not end up with a", " zombie PREFIX in the pool in expat/tests/nsalloc_tests.c.", " - CVE-2026-32778", " * SECURITY UPDATE: denial of service via moderately sized crafted XML input", " - debian/patches/CVE-2026-45186-1.patch: Make", " \"counting_start_element_handler\" count default attrs in", " expat/tests/basic_tests.c, expat/tests/handlers.c, expat/tests/handlers.h.", " - debian/patches/CVE-2026-45186-2.patch: test(attlist): Cover duplicate", " attribute names in expat/tests/basic_tests.c.", " - debian/patches/CVE-2026-45186-3-pre.patch: tests: Migrate test_attributes", " off of g_parser in expat/tests/basic_tests.c.", " - debian/patches/CVE-2026-45186-3.patch: tests: Define .attributes the first", " time around in expat/tests/basic_tests.c.", " - debian/patches/CVE-2026-45186-4.patch: tests: Make", " counting_start_element_handler enforce complete attribute lists in", " expat/tests/handlers.c.", " - debian/patches/CVE-2026-45186-5.patch: lib: Extract a constant for", " upcoming reuse in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-45186-6.patch: lib: Introduce", " ELEMENT_TYPE.defaultAttsNames in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-45186-7.patch: lib: Leverage", " ELEMENT_TYPE.defaultAttsNames for attribute collision detection in", " expat/lib/xmlparse.c.", " - CVE-2026-45186", " * SECURITY UPDATE: hash flooding caused by insufficient entropy", " - debian/patches/CVE-2026-41080-1-pre.patch: lib/xmlparse.c: Address clang-", " tidy warning misc-no-recursion in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-1.patch: lib: Inline function", " `get_hash_secret_salt` in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-2.patch: lib: Drop unused parameter from", " function `generate_hash_secret_salt` in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-3.patch: lib: Migrate hash salt storage to", " larger `struct sipkey` in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-4.patch: lib: Drop unneeded `void *` casts", " in function `generate_hash_secret_salt` in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-5-pre.patch: WASI: remove getpid in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-5.patch: lib: Extract 16 bytes of entropy", " (instead of 4 to 8) for hash flooding protection in expat/lib/internal.h,", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-6.patch: lib: Introduce internal flag", " `m_hash_secret_salt_set` in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-7.patch: lib: Introduce API function", " `XML_SetHashSalt16Bytes` in expat/lib/expat.h, expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-8.patch: lib: Include `XML_SetHashSalt*`", " with entropy debugging in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-9.patch: tests: Add basic coverage to", " `XML_SetHashSalt16Bytes` in expat/tests/basic_tests.c.", " - debian/patches/CVE-2026-41080-10.patch: doc: Document `XML_SetHashSalt` as", " being deprecated in expat/lib/expat.h, expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-41080-11.patch: cmake|windows: add missing export", " for new XML_SetHashSalt16Bytes in expat/lib/libexpat.def.cmake.", " - CVE-2026-41080", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56408.patch: lib: Waterproof `copyString` from", " integer overflow in expat/lib/xmlparse.c.", " - CVE-2026-56408", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56403-pre1.patch: Replace the empty for-loops with", " while loops in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56403-1.patch: lib: Protect function `storeAtts`", " from signed integer overflow in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56403-2.patch: xmlwf: Protect function `xcsdup`", " from signed integer overflow in expat/xmlwf/xmlwf.c.", " - CVE-2026-56403", " * SECURITY UPDATE: use after free", " - debian/patches/CVE-2026-50219-1.patch: lib: Introduce handler call depth", " tracking in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-2.patch: lib: Prepare", " `m_notStandaloneHandler` calls for upcoming wrapping in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-3.patch: lib: Prepare", " `m_externalEntityRefHandler` calls for upcoming wrapping in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-4.patch: lib: Prepare", " `m_unknownEncodingHandler` calls for upcoming wrapping in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-5.patch: lib: Register", " `m_attlistDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-6.patch: lib: Register", " `m_characterDataHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-7.patch: lib: Register `m_commentHandler`", " with handler call depth tracking in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-8.patch: lib: Register `m_defaultHandler`", " with handler call depth tracking in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-9.patch: lib: Register", " `m_elementDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-10.patch: lib: Register", " `m_endCdataSectionHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-11.patch: lib: Register", " `m_endDoctypeDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-12.patch: lib: Register", " `m_endElementHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-13.patch: lib: Register", " `m_endNamespaceDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-14.patch: lib: Register", " `m_entityDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-15.patch: lib: Register", " `m_externalEntityRefHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-16.patch: lib: Register", " `m_notationDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-17.patch: lib: Register", " `m_notStandaloneHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-18.patch: lib: Register", " `m_processingInstructionHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-19.patch: lib: Register", " `m_skippedEntityHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-20.patch: lib: Register", " `m_startCdataSectionHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-21.patch: lib: Register", " `m_startDoctypeDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-22.patch: lib: Register", " `m_startElementHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-23.patch: lib: Register", " `m_startNamespaceDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-24.patch: lib: Register", " `m_unknownEncodingHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-25.patch: lib: Register", " `m_unparsedEntityDeclHandler` with handler call depth tracking in", " expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-26.patch: lib: Register `m_xmlDeclHandler`", " with handler call depth tracking in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-27.patch: lib: Protect `XML_GetBuffer` from", " being called from a handler in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-28.patch: lib: Protect `XML_Parse` from", " being called from a handler in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-29.patch: lib: Protect `XML_ParseBuffer`", " from being called from a handler in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-30.patch: lib: Protect `XML_ParserFree` from", " being called from a handler in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-31.patch: lib: Protect `XML_ParserReset`", " from being called from a handler in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-50219-32.patch: tests: Cover calls forbidden from", " handlers in expat/tests/handlers.c, expat/tests/handlers.h,", " expat/tests/misc_tests.c.", " - CVE-2026-50219", " * SECURITY UPDATE: use after free (fix for CVE-2026-50219 was incomplete)", " - debian/patches/CVE-2026-56412.patch: lib: guard XML_TOK_DATA_CHARS handler", " calls in doCdataSection() in expat/lib/xmlparse.c.", " - CVE-2026-56412", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56404.patch: lib: protect function addBinding from", " signed integer overflow in expat/lib/xmlparse.c.", " - CVE-2026-56404", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56405.patch: lib: Protect function getAttributeId", " from signed integer overflow in expat/lib/xmlparse.c.", " - CVE-2026-56405", "" ], "package": "expat", "version": "2.6.1-2ubuntu0.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Fri, 11 Sep 2026 10:26:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-0t64", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.8", "version": "2.80.0-6ubuntu3.8" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.9", "version": "2.80.0-6ubuntu3.9" }, "cves": [ { "cve": "CVE-2026-58010", "url": "https://ubuntu.com/security/CVE-2026-58010", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58011", "url": "https://ubuntu.com/security/CVE-2026-58011", "cve_description": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58012", "url": "https://ubuntu.com/security/CVE-2026-58012", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58013", "url": "https://ubuntu.com/security/CVE-2026-58013", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58014", "url": "https://ubuntu.com/security/CVE-2026-58014", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58015", "url": "https://ubuntu.com/security/CVE-2026-58015", "cve_description": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58016", "url": "https://ubuntu.com/security/CVE-2026-58016", "cve_description": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-15588", "url": "https://ubuntu.com/security/CVE-2026-15588", "cve_description": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.", "cve_priority": "medium", "cve_public_date": "2026-07-20 12:17:00 UTC" }, { "cve": "CVE-2026-16118", "url": "https://ubuntu.com/security/CVE-2026-16118", "cve_description": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.", "cve_priority": "medium", "cve_public_date": "2026-07-17 20:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-58010", "url": "https://ubuntu.com/security/CVE-2026-58010", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58011", "url": "https://ubuntu.com/security/CVE-2026-58011", "cve_description": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58012", "url": "https://ubuntu.com/security/CVE-2026-58012", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58013", "url": "https://ubuntu.com/security/CVE-2026-58013", "cve_description": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58014", "url": "https://ubuntu.com/security/CVE-2026-58014", "cve_description": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58015", "url": "https://ubuntu.com/security/CVE-2026-58015", "cve_description": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-58016", "url": "https://ubuntu.com/security/CVE-2026-58016", "cve_description": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-30 13:19:00 UTC" }, { "cve": "CVE-2026-15588", "url": "https://ubuntu.com/security/CVE-2026-15588", "cve_description": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.", "cve_priority": "medium", "cve_public_date": "2026-07-20 12:17:00 UTC" }, { "cve": "CVE-2026-16118", "url": "https://ubuntu.com/security/CVE-2026-16118", "cve_description": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.", "cve_priority": "medium", "cve_public_date": "2026-07-17 20:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: off-by-one OOB read in GVariant serialiser", " - debian/patches/CVE-2026-58010.patch: fix bounds check to use >= instead", " of > in gvs_tuple_is_normal() in glib/gvariant-serialiser.c.", " - CVE-2026-58010", " * SECURITY UPDATE: OOB read in GDateTime", " - debian/patches/CVE-2026-58011.patch: add missing range validation to", " g_date_time_add_full() in glib/gdatetime.c.", " - CVE-2026-58011", " * SECURITY UPDATE: buffer over-read in g_regex_replace", " - debian/patches/CVE-2026-58012.patch: fix case-change substitution", " handling with G_REGEX_RAW in glib/gregex.c.", " - CVE-2026-58012", " * SECURITY UPDATE: buffer over-read in GIOChannel", " - debian/patches/CVE-2026-58013.patch: add length check before memcmp", " in g_io_channel_read_line_backend() in glib/giochannel.c.", " - CVE-2026-58013", " * SECURITY UPDATE: off-by-one heap under-read in GKeyFile", " - debian/patches/CVE-2026-58014.patch: add len > 0 check before", " accessing value[len-1] in g_key_file_get_locale_string_list() in", " glib/gkeyfile.c.", " - CVE-2026-58014", " * SECURITY UPDATE: path traversal in DBUS_COOKIE_SHA1 auth", " - debian/patches/CVE-2026-58015.patch: validate cookie_context parameter", " to prevent path traversal in gio/gdbusauthmechanismsha1.c.", " - CVE-2026-58015", " * SECURITY UPDATE: state confusion in D-Bus introspection XML parser", " - debian/patches/CVE-2026-58016.patch: fix node element nesting check", " and add assertions in gio/gdbusintrospection.c.", " - CVE-2026-58016", " * SECURITY UPDATE: resource exhaustion in GDBus authentication", " - debian/patches/CVE-2026-15588.patch: limit length of lines read from", " client in gio/gdbusauth.c.", " - CVE-2026-15588", " * SECURITY UPDATE: heap buffer overflow in xdgmime", " - debian/patches/CVE-2026-16118.patch: fix pointer arithmetic in", " byte-swap routine in gio/xdgmime/xdgmimemagic.c.", " - CVE-2026-16118", "" ], "package": "glib2.0", "version": "2.80.0-6ubuntu3.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Tue, 08 Sep 2026 14:07:47 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgssapi-krb5-2", "from_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.8", "version": "1.20.1-6ubuntu2.8" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.10", "version": "1.20.1-6ubuntu2.10" }, "cves": [], "launchpad_bugs_fixed": [ 2162744 ], "changes": [ { "cves": [], "log": [ "", " * d/t/control: Don't run kinit-pwexpire on 32-bit architectures", " The test verifies correct behavior for dates in the far future", " (~70 years after the time of test), which krb5's date parser", " only accepts on 64 bit arches.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Grayson Wolf ", "date": "Thu, 20 Aug 2026 09:07:25 -0400" }, { "cves": [], "log": [ "", " * d/p/lp2162744-ts-interval.patch: Add ts_interval to accomodate", " for large time intervals (LP: #2162744)", " * d/t/kinit-pwexpire: Add test that long PW expiry dates", " do not overflow and produce wrong messages.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.9", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162744 ], "author": "Grayson Wolf ", "date": "Tue, 11 Aug 2026 17:30:54 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libk5crypto3", "from_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.8", "version": "1.20.1-6ubuntu2.8" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.10", "version": "1.20.1-6ubuntu2.10" }, "cves": [], "launchpad_bugs_fixed": [ 2162744 ], "changes": [ { "cves": [], "log": [ "", " * d/t/control: Don't run kinit-pwexpire on 32-bit architectures", " The test verifies correct behavior for dates in the far future", " (~70 years after the time of test), which krb5's date parser", " only accepts on 64 bit arches.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Grayson Wolf ", "date": "Thu, 20 Aug 2026 09:07:25 -0400" }, { "cves": [], "log": [ "", " * d/p/lp2162744-ts-interval.patch: Add ts_interval to accomodate", " for large time intervals (LP: #2162744)", " * d/t/kinit-pwexpire: Add test that long PW expiry dates", " do not overflow and produce wrong messages.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.9", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162744 ], "author": "Grayson Wolf ", "date": "Tue, 11 Aug 2026 17:30:54 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libkrb5-3", "from_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.8", "version": "1.20.1-6ubuntu2.8" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.10", "version": "1.20.1-6ubuntu2.10" }, "cves": [], "launchpad_bugs_fixed": [ 2162744 ], "changes": [ { "cves": [], "log": [ "", " * d/t/control: Don't run kinit-pwexpire on 32-bit architectures", " The test verifies correct behavior for dates in the far future", " (~70 years after the time of test), which krb5's date parser", " only accepts on 64 bit arches.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Grayson Wolf ", "date": "Thu, 20 Aug 2026 09:07:25 -0400" }, { "cves": [], "log": [ "", " * d/p/lp2162744-ts-interval.patch: Add ts_interval to accomodate", " for large time intervals (LP: #2162744)", " * d/t/kinit-pwexpire: Add test that long PW expiry dates", " do not overflow and produce wrong messages.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.9", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162744 ], "author": "Grayson Wolf ", "date": "Tue, 11 Aug 2026 17:30:54 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libkrb5support0", "from_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.8", "version": "1.20.1-6ubuntu2.8" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.20.1-6ubuntu2.10", "version": "1.20.1-6ubuntu2.10" }, "cves": [], "launchpad_bugs_fixed": [ 2162744 ], "changes": [ { "cves": [], "log": [ "", " * d/t/control: Don't run kinit-pwexpire on 32-bit architectures", " The test verifies correct behavior for dates in the far future", " (~70 years after the time of test), which krb5's date parser", " only accepts on 64 bit arches.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Grayson Wolf ", "date": "Thu, 20 Aug 2026 09:07:25 -0400" }, { "cves": [], "log": [ "", " * d/p/lp2162744-ts-interval.patch: Add ts_interval to accomodate", " for large time intervals (LP: #2162744)", " * d/t/kinit-pwexpire: Add test that long PW expiry dates", " do not overflow and produce wrong messages.", "" ], "package": "krb5", "version": "1.20.1-6ubuntu2.9", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162744 ], "author": "Grayson Wolf ", "date": "Tue, 11 Aug 2026 17:30:54 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnetplan1", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.2", "version": "1.1.2-8ubuntu1~24.04.2" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.3", "version": "1.1.2-8ubuntu1~24.04.3" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.1.2-8ubuntu1~24.04.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:19:49 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12-minimal", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.12-stdlib", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsqlite3-0", "from_version": { "source_package_name": "sqlite3", "source_package_version": "3.45.1-1ubuntu2.7", "version": "3.45.1-1ubuntu2.7" }, "to_version": { "source_package_name": "sqlite3", "source_package_version": "3.45.1-1ubuntu2.8", "version": "3.45.1-1ubuntu2.8" }, "cves": [ { "cve": "CVE-2026-39113", "url": "https://ubuntu.com/security/CVE-2026-39113", "cve_description": "Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components", "cve_priority": "medium", "cve_public_date": "2026-08-25 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-39113", "url": "https://ubuntu.com/security/CVE-2026-39113", "cve_description": "Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components", "cve_priority": "medium", "cve_public_date": "2026-08-25 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: buffer overflow via integer truncation in sqlar extension", " - debian/patches/CVE-2026-39113.patch: change sqlite3_value_int() to", " sqlite3_value_int64() in sqlarUncompressFunc() in ext/misc/sqlar.c to", " prevent 32-bit truncation of the decompressed size, which caused an", " undersized buffer allocation and heap buffer overflow via uncompress().", " - CVE-2026-39113", "" ], "package": "sqlite3", "version": "3.45.1-1ubuntu2.8", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Thu, 03 Sep 2026 11:45:26 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "netplan-generator", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.2", "version": "1.1.2-8ubuntu1~24.04.2" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.3", "version": "1.1.2-8ubuntu1~24.04.3" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.1.2-8ubuntu1~24.04.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:19:49 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "netplan.io", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.2", "version": "1.1.2-8ubuntu1~24.04.2" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.3", "version": "1.1.2-8ubuntu1~24.04.3" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.1.2-8ubuntu1~24.04.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:19:49 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.4", "version": "5.38.2-3.2ubuntu0.4" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.6", "version": "5.38.2-3.2ubuntu0.6" }, "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-15534", "url": "https://ubuntu.com/security/CVE-2026-15534", "cve_description": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-09 18:16:00 UTC" }, { "cve": "CVE-2026-19487", "url": "https://ubuntu.com/security/CVE-2026-19487", "cve_description": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: \"ABCDE\" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.", "cve_priority": "medium", "cve_public_date": "2026-08-13 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read and write during regular", " expression matching", " - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache", " countdown unsigned in regexec.c.", " - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit", " clean in regexec.c, regexp.h.", " - CVE-2026-15534", " * SECURITY UPDATE: Incorrect regular expression matches from stale", " Aho-Corasick failure flag", " - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in", " Aho-Corasick prescan in regexec.c, t/re/re_tests.", " - CVE-2026-19487", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Mon, 14 Sep 2026 13:50:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python-apt-common", "from_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.2", "version": "2.7.7ubuntu5.2" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.3", "version": "2.7.7ubuntu5.3" }, "cves": [], "launchpad_bugs_fixed": [ 2166601 ], "changes": [ { "cves": [], "log": [ "", " * Mirror list update for 24.04.5 (LP: #2166601)", "" ], "package": "python-apt", "version": "2.7.7ubuntu5.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2166601 ], "author": "Graham Inggs ", "date": "Sun, 06 Sep 2026 14:01:38 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-apt", "from_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.2", "version": "2.7.7ubuntu5.2" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "2.7.7ubuntu5.3", "version": "2.7.7ubuntu5.3" }, "cves": [], "launchpad_bugs_fixed": [ 2166601 ], "changes": [ { "cves": [], "log": [ "", " * Mirror list update for 24.04.5 (LP: #2166601)", "" ], "package": "python-apt", "version": "2.7.7ubuntu5.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2166601 ], "author": "Graham Inggs ", "date": "Sun, 06 Sep 2026 14:01:38 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distupgrade", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.28", "version": "1:24.04.28" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.29", "version": "1:24.04.29" }, "cves": [], "launchpad_bugs_fixed": [ 2078579, 2166415 ], "changes": [ { "cves": [], "log": [ "", " * Install dependencies of t64 packages (LP: #2078579)", " * Run pre-build.sh: updating mirrors (and .po offsets) for point release.", " (LP: #2166415)", "" ], "package": "ubuntu-release-upgrader", "version": "1:24.04.29", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2078579, 2166415 ], "author": "Julian Andres Klode ", "date": "Thu, 03 Sep 2026 23:11:07 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-netplan", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.2", "version": "1.1.2-8ubuntu1~24.04.2" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.1.2-8ubuntu1~24.04.3", "version": "1.1.2-8ubuntu1~24.04.3" }, "cves": [], "launchpad_bugs_fixed": [ 2104373 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2104373-return-exit-code-1-on-error.patch: return exit code 1 when", " netplan exits on error (LP: #2104373)", "" ], "package": "netplan.io", "version": "1.1.2-8ubuntu1~24.04.3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2104373 ], "author": "Guilherme Puida Moreira ", "date": "Mon, 31 Aug 2026 09:19:49 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.12", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.12-minimal", "from_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.16", "version": "3.12.3-1ubuntu0.16" }, "to_version": { "source_package_name": "python3.12", "source_package_version": "3.12.3-1ubuntu0.17", "version": "3.12.3-1ubuntu0.17" }, "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4360", "url": "https://ubuntu.com/security/CVE-2026-4360", "cve_description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "cve_priority": "medium", "cve_public_date": "2026-06-30 15:16:00 UTC" }, { "cve": "CVE-2026-15308", "url": "https://ubuntu.com/security/CVE-2026-15308", "cve_description": "The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.", "cve_priority": "medium", "cve_public_date": "2026-07-09 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Incomplete filter application in tarfile extraction", " - debian/patches/CVE-2026-4360.patch: pass the filter function through", " extract() to target extraction in Lib/tarfile.py,", " Lib/test/test_tarfile.py.", " - CVE-2026-4360", " * SECURITY UPDATE: Quadratic complexity in incremental HTML parsing", " - debian/patches/CVE-2026-15308.patch: fix quadratic complexity in", " incremental parsing in HTMLParser in Lib/html/parser.py,", " Lib/test/test_htmlparser.py.", " - CVE-2026-15308", "" ], "package": "python3.12", "version": "3.12.3-1ubuntu0.17", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Mon, 31 Aug 2026 11:18:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-release-upgrader-core", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.28", "version": "1:24.04.28" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:24.04.29", "version": "1:24.04.29" }, "cves": [], "launchpad_bugs_fixed": [ 2078579, 2166415 ], "changes": [ { "cves": [], "log": [ "", " * Install dependencies of t64 packages (LP: #2078579)", " * Run pre-build.sh: updating mirrors (and .po offsets) for point release.", " (LP: #2166415)", "" ], "package": "ubuntu-release-upgrader", "version": "1:24.04.29", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2078579, 2166415 ], "author": "Julian Andres Klode ", "date": "Thu, 03 Sep 2026 23:11:07 +0200" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from release image serial 20260905 to 20260922", "from_series": "noble", "to_series": "noble", "from_serial": "20260905", "to_serial": "20260922", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }