NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

Remediation

Upgrade Ubuntu:24.04 libssh to version 0.10.6-2ubuntu0.5 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59847
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59847
• https://bugzilla.redhat.com/show_bug.cgi?id=2498180
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

Remediation

Upgrade Ubuntu:24.04 libssh to version 0.10.6-2ubuntu0.5 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59850
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59850
• https://bugzilla.redhat.com/show_bug.cgi?id=2498183
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.

_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.

A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-9538
• https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch
• https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes
• http://www.openwall.com/lists/oss-security/2026/05/26/4

NVD Description

Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Remediation

Upgrade Ubuntu:24.04 attr to version 1:2.5.2-1ubuntu0.1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-54371
• https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f
• https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b
• https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr
• https://access.redhat.com/security/cve/CVE-2026-54371
• https://bugzilla.redhat.com/show_bug.cgi?id=2490283
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json
• https://access.redhat.com/errata/RHSA-2026:34889
• https://access.redhat.com/errata/RHSA-2026:56133
• https://access.redhat.com/errata/RHSA-2026:59380
• https://access.redhat.com/errata/RHSA-2026:60226
• https://access.redhat.com/errata/RHSA-2026:61783

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

Remediation

Upgrade Ubuntu:24.04 libssh to version 0.10.6-2ubuntu0.5 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59843
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59843
• https://bugzilla.redhat.com/show_bug.cgi?id=2498176
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.

Remediation

Upgrade Ubuntu:24.04 p11-kit to version 0.25.3-4ubuntu2.2 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18938
• https://access.redhat.com/security/cve/CVE-2026-18938
• https://bugzilla.redhat.com/show_bug.cgi?id=2478995

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Remediation

Upgrade Ubuntu:24.04 p11-kit to version 0.25.3-4ubuntu2.2 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13757
• https://access.redhat.com/errata/RHSA-2026:37469
• https://access.redhat.com/errata/RHSA-2026:38342
• https://access.redhat.com/errata/RHSA-2026:49668
• https://access.redhat.com/security/cve/CVE-2026-13757
• https://bugzilla.redhat.com/show_bug.cgi?id=2494556
• https://github.com/advisories/GHSA-p2wm-69qx-x25w
• https://access.redhat.com/errata/RHSA-2026:49667
• https://access.redhat.com/errata/RHSA-2026:53371
• https://access.redhat.com/errata/RHSA-2026:54387
• https://access.redhat.com/errata/RHSA-2026:54760
• https://access.redhat.com/errata/RHSA-2026:58981

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

Remediation

Upgrade Ubuntu:24.04 libssh to version 0.10.6-2ubuntu0.5 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59845
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59845
• https://bugzilla.redhat.com/show_bug.cgi?id=2498178
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

Remediation

Upgrade Ubuntu:24.04 libssh to version 0.10.6-2ubuntu0.5 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59848
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59848
• https://bugzilla.redhat.com/show_bug.cgi?id=2498181
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

Remediation

Upgrade Ubuntu:24.04 util-linux to version 2.39.3-9ubuntu6.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13595
• https://access.redhat.com/errata/RHSA-2026:26573
• https://access.redhat.com/security/cve/CVE-2026-13595
• https://bugzilla.redhat.com/show_bug.cgi?id=2494101
• https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Remediation

There is no fixed version for Ubuntu:24.04 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18508
• https://access.redhat.com/errata/RHSA-2026:50807
• https://access.redhat.com/security/cve/CVE-2026-18508
• https://bugzilla.redhat.com/show_bug.cgi?id=2509843
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:61586

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

Remediation

There is no fixed version for Ubuntu:24.04 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18477
• https://access.redhat.com/errata/RHSA-2026:49361
• https://access.redhat.com/security/cve/CVE-2026-18477
• https://bugzilla.redhat.com/show_bug.cgi?id=2509735
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:61586

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

Remediation

Upgrade Ubuntu:24.04 libssh to version 0.10.6-2ubuntu0.5 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59846
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59846
• https://bugzilla.redhat.com/show_bug.cgi?id=2498179
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.12 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11856
• https://curl.se/docs/CVE-2026-11856.html
• https://curl.se/docs/CVE-2026-11856.json
• https://hackerone.com/reports/3793260

NVD Description

Note: Versions mentioned in the description apply only to the upstream diffutils package and not the diffutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.

This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 

NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.

Remediation

Upgrade Ubuntu:24.04 diffutils to version 1:3.10-1ubuntu0.1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53910
• https://cert.pl/en/posts/2026/07/CVE-2026-53910
• https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
• https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815
• https://git.savannah.gnu.org/cgit/diffutils.git/

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.

This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18374
• https://sourceware.org/bugzilla/show_bug.cgi?id=34574
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015
• http://www.openwall.com/lists/oss-security/2026/08/27/6

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write.

Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service.

CWE: CWE-787: Out-of-bounds Write

Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure.

The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation.

FIPS impact: no

As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.15 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-63072
• https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756
• https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42
• https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335
• https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a
• https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
• https://openssl-library.org/news/secadv/20260825.txt

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer.

Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service.

CWE: CWE-476: NULL Pointer Dereference

Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted.

This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable.

FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.15 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-63076
• https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b
• https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e
• https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259
• https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226
• https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c
• https://openssl-library.org/news/secadv/20260825.txt

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-15649
• https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch
• https://github.com/pmqs/IO-Compress/issues/65
• https://metacpan.org/release/PMQS/IO-Compress-2.215/changes
• http://www.openwall.com/lists/oss-security/2026/05/27/1

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-12087
• https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch
• https://metacpan.org/release/PEVANS/Socket-2.041/changes
• http://www.openwall.com/lists/oss-security/2026/06/15/10

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13221
• https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch
• https://github.com/Perl/perl5/issues/23388
• http://www.openwall.com/lists/oss-security/2026/07/13/5

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.

fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.

Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-48959
• https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch
• https://metacpan.org/release/PMQS/IO-Compress-2.220/changes
• http://www.openwall.com/lists/oss-security/2026/05/27/2

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

Arbitrary Perl in the output glob executes at the calling process's privilege.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-48962
• https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch
• https://metacpan.org/release/PMQS/IO-Compress-2.220/changes
• http://www.openwall.com/lists/oss-security/2026/05/27/4
• https://access.redhat.com/errata/RHSA-2026:29182
• https://access.redhat.com/errata/RHSA-2026:29210
• https://access.redhat.com/errata/RHSA-2026:29867
• https://access.redhat.com/errata/RHSA-2026:29941
• https://access.redhat.com/errata/RHSA-2026:30085
• https://access.redhat.com/errata/RHSA-2026:30086
• https://access.redhat.com/errata/RHSA-2026:30115
• https://access.redhat.com/errata/RHSA-2026:30843
• https://access.redhat.com/errata/RHSA-2026:30851
• https://access.redhat.com/errata/RHSA-2026:30858
• https://access.redhat.com/errata/RHSA-2026:30859
• https://access.redhat.com/errata/RHSA-2026:30860
• https://access.redhat.com/security/cve/CVE-2026-48962
• https://bugzilla.redhat.com/show_bug.cgi?id=2481767
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json
• https://access.redhat.com/errata/RHSA-2026:50262

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-57432
• https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
• https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
• http://www.openwall.com/lists/oss-security/2026/07/13/6

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.

retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.

A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-57433
• https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch
• http://www.openwall.com/lists/oss-security/2026/07/13/7

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 perl to version 5.38.2-3.2ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-7017

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

Remediation

Upgrade Ubuntu:24.04 systemd to version 255.4-1ubuntu8.17 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-15059
• https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

Remediation

Upgrade Ubuntu:24.04 systemd to version 255.4-1ubuntu8.17 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-16742
• https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 util-linux to version 2.39.3-9ubuntu6.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53612

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 util-linux to version 2.39.3-9ubuntu6.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53613

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 util-linux to version 2.39.3-9ubuntu6.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53614

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 util-linux to version 2.39.3-9ubuntu6.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53615

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Remediation

Upgrade Ubuntu:24.04 util-linux to version 2.39.3-9ubuntu6.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-27456
• https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4
• https://github.com/util-linux/util-linux/releases/tag/v2.41.4
• https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g