{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "apt", "ca-certificates", "libapt-pkg6.0", "libglib2.0-0", "libglib2.0-data", "libpcre2-8-0", "xfsprogs" ] } }, "diff": { "deb": [ { "name": "apt", "from_version": { "source_package_name": "apt", "source_package_version": "2.4.14", "version": "2.4.14" }, "to_version": { "source_package_name": "apt", "source_package_version": "2.4.15ubuntu0.1", "version": "2.4.15ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Download verification bypass", " - methods/*.cc: Open target files exclusively", " - CVE-2026-109518", " * SECURITY UPDATE: Out-of-bounds accesses", " - deb: guard against unsigned underflow when trimming control newlines", " - gpgv: don't advance past the null terminator in PushEntryWithKeyID", " - debDebFileParser: reject .deb without a Version field", " - srvrec: reject res_query answers bigger than our buffer", " - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check", " * Test suite reliability:", " - test: Limit valgrind to 1024 open files", "" ], "package": "apt", "version": "2.4.15ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 02 Nov 2026 13:56:44 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.22.04.1", "version": "20260816ubuntu0.22.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.22.04.2", "version": "20260816ubuntu0.22.04.2" }, "cves": [], "launchpad_bugs_fixed": [ 2061817 ], "changes": [ { "cves": [], "log": [ "", " * debian/ca-certificates.postinst: only populate /etc/ssl/certs without", " running the hooks on initial installs. On upgrades, running", " update-ca-certificates synchronously with an empty hooksdir consumed", " the pending changes, so the deferred update-ca-certificates trigger", " reported \"0 added, 0 removed\" and the hooks in", " /etc/ca-certificates/update.d (ca-certificates-java,", " ca-certificates-mono) were never told which certificates were added", " or removed. Their keystores drifted from the system trust store and", " kept trusting CAs removed from /etc/ssl/certs, including the eMudhra", " root blacklisted in 20260816ubuntu0.22.04.1 (LP: #2061817,", " Debian #1069251).", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.22.04.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2061817 ], "author": "Vyom Yadav ", "date": "Thu, 22 Oct 2026 18:52:38 +0530" } ], "notes": null, "is_version_downgrade": false }, { "name": "libapt-pkg6.0", "from_version": { "source_package_name": "apt", "source_package_version": "2.4.14", "version": "2.4.14" }, "to_version": { "source_package_name": "apt", "source_package_version": "2.4.15ubuntu0.1", "version": "2.4.15ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Download verification bypass", " - methods/*.cc: Open target files exclusively", " - CVE-2026-109518", " * SECURITY UPDATE: Out-of-bounds accesses", " - deb: guard against unsigned underflow when trimming control newlines", " - gpgv: don't advance past the null terminator in PushEntryWithKeyID", " - debDebFileParser: reject .deb without a Version field", " - srvrec: reject res_query answers bigger than our buffer", " - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check", " * Test suite reliability:", " - test: Limit valgrind to 1024 open files", "" ], "package": "apt", "version": "2.4.15ubuntu0.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 02 Nov 2026 13:56:44 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-0", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.10", "version": "2.72.4-0ubuntu2.10" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.11", "version": "2.72.4-0ubuntu2.11" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.72.4-0ubuntu2.11", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 16:21:29 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-data", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.10", "version": "2.72.4-0ubuntu2.10" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.72.4-0ubuntu2.11", "version": "2.72.4-0ubuntu2.11" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.72.4-0ubuntu2.11", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 16:21:29 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpcre2-8-0", "from_version": { "source_package_name": "pcre2", "source_package_version": "10.39-3ubuntu0.1", "version": "10.39-3ubuntu0.1" }, "to_version": { "source_package_name": "pcre2", "source_package_version": "10.39-3ubuntu0.2", "version": "10.39-3ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-103111", "url": "https://ubuntu.com/security/CVE-2026-103111", "cve_description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "cve_priority": "medium", "cve_public_date": "2026-09-30 05:16:00 UTC" }, { "cve": "CVE-2026-86145", "url": "https://ubuntu.com/security/CVE-2026-86145", "cve_description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "cve_priority": "medium", "cve_public_date": "2026-09-05 06:17:00 UTC" }, { "cve": "CVE-2026-89156", "url": "https://ubuntu.com/security/CVE-2026-89156", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89157", "url": "https://ubuntu.com/security/CVE-2026-89157", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89158", "url": "https://ubuntu.com/security/CVE-2026-89158", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89160", "url": "https://ubuntu.com/security/CVE-2026-89160", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89161", "url": "https://ubuntu.com/security/CVE-2026-89161", "cve_description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-103111", "url": "https://ubuntu.com/security/CVE-2026-103111", "cve_description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "cve_priority": "medium", "cve_public_date": "2026-09-30 05:16:00 UTC" }, { "cve": "CVE-2026-86145", "url": "https://ubuntu.com/security/CVE-2026-86145", "cve_description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "cve_priority": "medium", "cve_public_date": "2026-09-05 06:17:00 UTC" }, { "cve": "CVE-2026-89156", "url": "https://ubuntu.com/security/CVE-2026-89156", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89157", "url": "https://ubuntu.com/security/CVE-2026-89157", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89158", "url": "https://ubuntu.com/security/CVE-2026-89158", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89160", "url": "https://ubuntu.com/security/CVE-2026-89160", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89161", "url": "https://ubuntu.com/security/CVE-2026-89161", "cve_description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Fix large JIT stack allocation.", " - src/pcre2_jit_compile.c: Track oversized stack allocations and compute", " the growth threshold from the stack top instead of assuming the stack", " starts near its base, preventing an out-of-bounds write.", " - Authors: Zoltan Herczeg, Nicholas Wilson", " - 2b4038298072684b0fae29b15bedfb1a75bda46d", " - 6f9d7c1373262c541324a16a358785b33ef116cf", " - CVE-2026-103111", " * SECURITY UPDATE: Fix DFA workspace overflows", " - src/pcre2_dfa_match.c: Size new workspace blocks to fit the current", " ovector request and stop reusing a next block that is too small,", " preventing workspace overflow past the heap limit.", " - testdata/testinput6, testdata/testoutput6: Regression tests for the", " workspace overflow cases.", " - Author: Nicholas Wilson", " - c932e70451eafef922ebef364ac25042f0031135", " - CVE-2026-86145", " * SECURITY UPDATE: Fix pcre2_match to check for JIT support before JIT", " validation & execution", " - src/pcre2_internal.h: Declare the new jit_check_exec() helper.", " - src/pcre2_jit_misc.c: Add jit_check_exec() to verify the requested", " matching mode is compiled in before running JIT code.", " - src/pcre2_match.c: Gate the JIT fast path on jit_check_exec() so a", " missing JIT mode falls through to the interpreter's own UTF validation", " instead of skipping it.", " - Author: Zoltan Herczeg", " - f67db227af31bba7cdf2a7a00b97af91b588c2f5", " - CVE-2026-89156", " * SECURITY UPDATE: Use CU2BYTES for byte sizing in two allocation sites", " - src/pcre2_convert.c, src/pcre2_substring.c: Size allocations with", " CU2BYTES() instead of multiplying by PCRE2_CODE_UNIT_WIDTH, and reject", " lengths that would overflow the size calculation.", " - Author: Ilia Alshanetsky", " - 8156b3989a82f2ddf9504d8248496e9b124be7f3", " - CVE-2026-89157", " * SECURITY UPDATE: Fix compiler integer overflows", " - src/pcre2_compile.c: Guard pattern length accumulation against", " OFLOW_MAX and MAX_PATTERN_SIZE overflow.", " - Author: Nicholas Wilson", " - ec9c286d5c10cf1c388b58a442ccefded42254fd", " - CVE-2026-89158", " * SECURITY UPDATE: Fix invalid UTF backwards-scan reads", " - src/pcre2_extuni.c, src/pcre2_match.c: Bound backwards scans at", " check_subject rather than start_subject so they cannot read into an", " invalid UTF prefix before it has been validated.", " - testdata/testinput10, testdata/testoutput10, testdata/testinput12,", " testdata/testoutput12-16, testdata/testoutput12-32: Regression tests", " for backwards scans over invalid UTF prefixes.", " - Author: Nicholas Wilson", " - 4889caf31a4c5a6b3c051f0031bf2dbd78f2c287", " - CVE-2026-89160", " * SECURITY UPDATE: Fix leak & stale PCRE2_MD_COPIED_SUBJECT if", " pcre2_jit_match used with existing match context.", " - src/pcre2_jit_match.c: Free a previously copied subject and clear the", " PCRE2_MD_COPIED_SUBJECT flag before reusing a match data block.", " - src/pcre2test.c: Detect a wrongly-set or wrongly-cleared copied-subject", " state after a JIT match.", " - testdata/testinput17, testdata/testoutput17: Test the copied-subject", " handling on the JIT fast path.", " - Author: Nicholas Wilson", " - 1dcd0cf42a6a7cb62cc9a7c024196733abcfda95", " - CVE-2026-89161", "" ], "package": "pcre2", "version": "10.39-3ubuntu0.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Thu, 15 Oct 2026 17:22:01 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "xfsprogs", "from_version": { "source_package_name": "xfsprogs", "source_package_version": "5.13.0-1ubuntu2.1", "version": "5.13.0-1ubuntu2.1" }, "to_version": { "source_package_name": "xfsprogs", "source_package_version": "5.13.0-1ubuntu2.2", "version": "5.13.0-1ubuntu2.2" }, "cves": [], "launchpad_bugs_fixed": [ 2101888 ], "changes": [ { "cves": [], "log": [ "", " * Prevent fsck.xfs from dropping into emergency mode when a forced repair", " encounters a dirty XFS journal (LP: #2101888).", " - d/p/lp2101888-replay-log-before-xfs-repair.patch: Mount and unmount the", " filesystem to replay its journal, then rerun xfs_repair.", "" ], "package": "xfsprogs", "version": "5.13.0-1ubuntu2.2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2101888 ], "author": "Seyeong Kim ", "date": "Mon, 14 Sep 2026 10:47:17 +0900" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20261028 to 20261104.2", "from_series": "jammy", "to_series": "jammy", "from_serial": "20261028", "to_serial": "20261104.2", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }