NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Remediation

Upgrade Ubuntu:22.04 perl to version 5.34.0-3ubuntu1.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13221
• https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch
• https://github.com/Perl/perl5/issues/23388
• http://www.openwall.com/lists/oss-security/2026/07/13/5

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Remediation

Upgrade Ubuntu:22.04 perl to version 5.34.0-3ubuntu1.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-57432
• https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
• https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
• http://www.openwall.com/lists/oss-security/2026/07/13/6

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-76957
• https://github.com/libexpat/libexpat/pull/1322
• https://github.com/libexpat/libexpat/pull/1329

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

Remediation

There is no fixed version for Ubuntu:22.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89161
• https://github.com/PCRE2Project/pcre2/pull/937
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl2 package and not the cyrus-sasl2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.

Remediation

There is no fixed version for Ubuntu:22.04 cyrus-sasl2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-107161
• https://access.redhat.com/security/cve/CVE-2026-107161
• https://bugzilla.redhat.com/show_bug.cgi?id=2460420
• http://www.openwall.com/lists/oss-security/2026/10/09/20

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Remediation

There is no fixed version for Ubuntu:22.04 expat.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45186
• https://github.com/libexpat/libexpat/pull/1216
• http://www.openwall.com/lists/oss-security/2026/05/11/16
• https://access.redhat.com/errata/RHSA-2026:22715
• https://access.redhat.com/errata/RHSA-2026:22721
• https://access.redhat.com/errata/RHSA-2026:23230
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:27201
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/security/cve/CVE-2026-45186
• https://bugzilla.redhat.com/show_bug.cgi?id=2468575
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json
• https://access.redhat.com/errata/RHSA-2026:58981

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-66046
• https://github.com/libexpat/libexpat/pull/1321
• https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-76641
• https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf
• https://github.com/libexpat/libexpat/pull/1331
• https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

Remediation

Upgrade Ubuntu:22.04 libssh to version 0.9.6-2ubuntu0.22.04.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59847
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62217
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/security/cve/CVE-2026-59847
• https://bugzilla.redhat.com/show_bug.cgi?id=2498180

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

Remediation

Upgrade Ubuntu:22.04 libssh to version 0.9.6-2ubuntu0.22.04.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59850
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59850
• https://bugzilla.redhat.com/show_bug.cgi?id=2498183
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.

Remediation

There is no fixed version for Ubuntu:22.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89157
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Remediation

There is no fixed version for Ubuntu:22.04 zlib.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-85091
• https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
• https://github.com/madler/zlib
• https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
• https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate

NVD Description

Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Remediation

Upgrade Ubuntu:22.04 attr to version 1:2.5.1-1ubuntu0.1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-54371
• https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f
• https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b
• https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr
• https://access.redhat.com/security/cve/CVE-2026-54371
• https://bugzilla.redhat.com/show_bug.cgi?id=2490283
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json
• https://access.redhat.com/errata/RHSA-2026:34889
• https://access.redhat.com/errata/RHSA-2026:56133
• https://access.redhat.com/errata/RHSA-2026:59380
• https://access.redhat.com/errata/RHSA-2026:60226
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:63135
• https://access.redhat.com/errata/RHSA-2026:63138
• https://access.redhat.com/errata/RHSA-2026:66018

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

Remediation

Upgrade Ubuntu:22.04 libssh to version 0.9.6-2ubuntu0.22.04.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59843
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59843
• https://bugzilla.redhat.com/show_bug.cgi?id=2498176
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.

Remediation

There is no fixed version for Ubuntu:22.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89158
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.

Remediation

There is no fixed version for Ubuntu:22.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89160
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.

Remediation

Upgrade Ubuntu:22.04 p11-kit to version 0.24.0-6ubuntu0.1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18938
• https://access.redhat.com/security/cve/CVE-2026-18938
• https://bugzilla.redhat.com/show_bug.cgi?id=2478995

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Remediation

Upgrade Ubuntu:22.04 p11-kit to version 0.24.0-6ubuntu0.1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13757
• https://access.redhat.com/errata/RHSA-2026:37469
• https://access.redhat.com/errata/RHSA-2026:38342
• https://access.redhat.com/errata/RHSA-2026:49668
• https://access.redhat.com/security/cve/CVE-2026-13757
• https://bugzilla.redhat.com/show_bug.cgi?id=2494556
• https://github.com/advisories/GHSA-p2wm-69qx-x25w
• https://access.redhat.com/errata/RHSA-2026:49667
• https://access.redhat.com/errata/RHSA-2026:53371
• https://access.redhat.com/errata/RHSA-2026:54387
• https://access.redhat.com/errata/RHSA-2026:54760
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:72394
• https://access.redhat.com/errata/RHSA-2026:72395
• https://access.redhat.com/errata/RHSA-2026:72399
• https://access.redhat.com/errata/RHSA-2026:72470
• https://access.redhat.com/errata/RHSA-2026:72475
• https://access.redhat.com/errata/RHSA-2026:72476
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:81201
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82336
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888

NVD Description

Note: Versions mentioned in the description apply only to the upstream wget package and not the wget package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Remediation

There is no fixed version for Ubuntu:22.04 wget.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2021-31879
• https://security.netapp.com/advisory/ntap-20210618-0002/
• https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-50219
• https://github.com/libexpat/libexpat/pull/1246

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

Remediation

Upgrade Ubuntu:22.04 libssh to version 0.9.6-2ubuntu0.22.04.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59845
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59845
• https://bugzilla.redhat.com/show_bug.cgi?id=2498178
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

Remediation

There is no fixed version for Ubuntu:22.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89156
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x

NVD Description

Note: Versions mentioned in the description apply only to the upstream dash package and not the dash package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as ....*.tar.gz consume excessive CPU.

Remediation

There is no fixed version for Ubuntu:22.04 dash.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-102473
• https://access.redhat.com/security/cve/CVE-2026-102473
• https://bugzilla.redhat.com/show_bug.cgi?id=2543005

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Remediation

There is no fixed version for Ubuntu:22.04 expat.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-66382
• https://github.com/libexpat/libexpat/issues/1076
• http://www.openwall.com/lists/oss-security/2025/12/02/1
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.7.5 allows an infinite loop while parsing DTD content.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-32777
• https://github.com/libexpat/libexpat/issues/1161
• https://github.com/libexpat/libexpat/pull/1159
• https://github.com/libexpat/libexpat/pull/1162
• https://issues.oss-fuzz.com/issues/486993411

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-32776
• https://github.com/libexpat/libexpat/pull/1158
• https://github.com/libexpat/libexpat/pull/1159

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-32778
• https://github.com/libexpat/libexpat/pull/1159
• https://github.com/libexpat/libexpat/pull/1163

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

Remediation

Upgrade Ubuntu:22.04 freetype to version 2.11.1+dfsg-1ubuntu0.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-95512
• https://access.redhat.com/security/cve/CVE-2026-95512
• https://bugzilla.redhat.com/show_bug.cgi?id=2462295
• https://gitlab.freedesktop.org/freetype/freetype/-/commit/f3ca71c9900fe860849b3163a6e2c1e765b291d9
• https://access.redhat.com/errata/RHSA-2026:74952

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

Remediation

Upgrade Ubuntu:22.04 libssh to version 0.9.6-2ubuntu0.22.04.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59848
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59848
• https://bugzilla.redhat.com/show_bug.cgi?id=2498181
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

Remediation

Upgrade Ubuntu:22.04 util-linux to version 2.37.2-4ubuntu3.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13595
• https://access.redhat.com/errata/RHSA-2026:26573
• https://access.redhat.com/security/cve/CVE-2026-13595
• https://bugzilla.redhat.com/show_bug.cgi?id=2494101
• https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Remediation

There is no fixed version for Ubuntu:22.04 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18508
• https://access.redhat.com/errata/RHSA-2026:50807
• https://access.redhat.com/security/cve/CVE-2026-18508
• https://bugzilla.redhat.com/show_bug.cgi?id=2509843
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:61586
• https://access.redhat.com/errata/RHSA-2026:66018
• https://access.redhat.com/errata/RHSA-2026:70390

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

Remediation

There is no fixed version for Ubuntu:22.04 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18477
• https://access.redhat.com/errata/RHSA-2026:49361
• https://access.redhat.com/security/cve/CVE-2026-18477
• https://bugzilla.redhat.com/show_bug.cgi?id=2509735
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:61586
• https://access.redhat.com/errata/RHSA-2026:66018
• https://access.redhat.com/errata/RHSA-2026:70390

NVD Description

Note: Versions mentioned in the description apply only to the upstream dash package and not the dash package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.

Remediation

There is no fixed version for Ubuntu:22.04 dash.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-102474
• https://access.redhat.com/security/cve/CVE-2026-102474
• https://bugzilla.redhat.com/show_bug.cgi?id=2543004

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

Remediation

Upgrade Ubuntu:22.04 libssh to version 0.9.6-2ubuntu0.22.04.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-59846
• https://access.redhat.com/errata/RHSA-2026:42922
• https://access.redhat.com/security/cve/CVE-2026-59846
• https://bugzilla.redhat.com/show_bug.cgi?id=2498179
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/errata/RHSA-2026:62218
• https://access.redhat.com/errata/RHSA-2026:62217

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

Remediation

Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.26 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11856
• https://curl.se/docs/CVE-2026-11856.html
• https://curl.se/docs/CVE-2026-11856.json
• https://hackerone.com/reports/3793260

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Remediation

Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.29 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18924
• https://curl.se/docs/CVE-2026-18924.html
• https://curl.se/docs/CVE-2026-18924.json
• https://hackerone.com/reports/3916059

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Remediation

There is no fixed version for Ubuntu:22.04 curl.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-19931
• https://curl.se/docs/CVE-2026-19931.html
• https://curl.se/docs/CVE-2026-19931.json
• https://hackerone.com/reports/3923520

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Remediation

Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.29 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-80230
• https://curl.se/docs/CVE-2026-80230.html
• https://curl.se/docs/CVE-2026-80230.json
• https://hackerone.com/reports/3969300

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).

Remediation

Upgrade Ubuntu:22.04 curl to version 7.81.0-1ubuntu1.29 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-82209
• https://curl.se/docs/CVE-2026-82209.html
• https://curl.se/docs/CVE-2026-82209.json
• https://hackerone.com/reports/3972385

NVD Description

Note: Versions mentioned in the description apply only to the upstream diffutils package and not the diffutils package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.

This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 

NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.

Remediation

Upgrade Ubuntu:22.04 diffutils to version 1:3.8-0ubuntu2.1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53910
• https://cert.pl/en/posts/2026/07/CVE-2026-53910
• https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
• https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815
• https://git.savannah.gnu.org/cgit/diffutils.git/

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Remediation

There is no fixed version for Ubuntu:22.04 expat.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-59375
• https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
• https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes
• https://github.com/libexpat/libexpat/issues/1018
• https://github.com/libexpat/libexpat/pull/1034
• https://issues.oss-fuzz.com/issues/439133977
• http://www.openwall.com/lists/oss-security/2025/09/16/2
• http://www.openwall.com/lists/oss-security/2026/05/01/5
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-089022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56132
• https://github.com/libexpat/libexpat/pull/1272

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Remediation

There is no fixed version for Ubuntu:22.04 expat.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-41080
• https://github.com/libexpat/libexpat/issues/47
• https://github.com/libexpat/libexpat/pull/1183
• https://blog.hartwork.org/posts/expat-2-8-0-released/
• https://www.openwall.com/lists/oss-security/2026/04/26/1
• http://www.openwall.com/lists/oss-security/2026/04/26/1

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56411
• https://github.com/libexpat/libexpat/pull/1263

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 has an integer overflow in addBinding.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56404
• https://github.com/libexpat/libexpat/pull/1249

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 has an integer overflow in copyString.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56408
• https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 has an integer overflow in getAttributeId.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56405
• https://github.com/libexpat/libexpat/pull/1251

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56410
• https://github.com/libexpat/libexpat/pull/1252

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56407
• https://github.com/libexpat/libexpat/pull/1262

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56406
• https://github.com/libexpat/libexpat/pull/1255

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56409
• https://github.com/libexpat/libexpat/pull/1259

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 has an integer overflow in storeAtts.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56403
• https://github.com/libexpat/libexpat/pull/1232

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-72522
• https://bugzilla.mozilla.org/show_bug.cgi?id=2053153
• https://github.com/libexpat/libexpat/pull/1296
• http://www.openwall.com/lists/oss-security/2026/08/11/5

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56131
• https://github.com/libexpat/libexpat/pull/1267

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

Remediation

Upgrade Ubuntu:22.04 expat to version 2.4.7-1ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56412
• https://github.com/libexpat/libexpat/pull/1278

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.

This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

Remediation

There is no fixed version for Ubuntu:22.04 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18374
• https://sourceware.org/bugzilla/show_bug.cgi?id=34574
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015
• http://www.openwall.com/lists/oss-security/2026/08/27/6

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.

The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.

Remediation

Upgrade Ubuntu:22.04 glibc to version 2.35-0ubuntu3.15 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-19542
• https://sourceware.org/bugzilla/show_bug.cgi?id=34506
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

Remediation

Upgrade Ubuntu:22.04 glibc to version 2.35-0ubuntu3.15 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6368
• https://sourceware.org/bugzilla/show_bug.cgi?id=34090
• https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

Remediation

Upgrade Ubuntu:22.04 glibc to version 2.35-0ubuntu3.15 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6791
• https://sourceware.org/bugzilla/show_bug.cgi?id=34091

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.

Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

Remediation

Upgrade Ubuntu:22.04 glibc to version 2.35-0ubuntu3.15 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-77117
• https://sourceware.org/bugzilla/show_bug.cgi?id=34556
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.

Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.

Remediation

Upgrade Ubuntu:22.04 glibc to version 2.35-0ubuntu3.15 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-80489
• https://sourceware.org/bugzilla/show_bug.cgi?id=34568
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.

Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.

There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.

Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.

Remediation

There is no fixed version for Ubuntu:22.04 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89092
• https://sourceware.org/bugzilla/show_bug.cgi?id=34624
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016
• http://www.openwall.com/lists/oss-security/2026/09/11/2

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)

Remediation

There is no fixed version for Ubuntu:22.04 gnutls28.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-67693
• http://gnutls.com
• https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238
• https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178
• https://gitlab.com/gnutls/gnutls/-/work_items/1642

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.

Remediation

There is no fixed version for Ubuntu:22.04 gnutls28.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-88647
• https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642
• https://gitlab.com/gnutls/gnutls/-/issues/1802

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).

Remediation

There is no fixed version for Ubuntu:22.04 gnutls28.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-95184
• http://gnutls.com
• https://evil.com
• https://gist.github.com/lkloliver/0c8b47fa75a0958fa88587665b82ae15
• https://www.gnutls.org

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).

Remediation

There is no fixed version for Ubuntu:22.04 gnutls28.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-95209
• http://gnutls.com
• https://evil.com
• https://gist.github.com/lkloliver/8e4498311aff18e2077010e412043e18
• https://www.gnutls.org

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.

Remediation

There is no fixed version for Ubuntu:22.04 gnutls28.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-95210
• http://gnutls.com
• https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7
• https://github.com/lkloliver/poc/tree/main/CVE-2026-95210

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:22.04 libpng1.6 to version 1.6.37-3ubuntu0.7 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-46675

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpng1.6 package and not the libpng1.6 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Remediation

Upgrade Ubuntu:22.04 libpng1.6 to version 1.6.37-3ubuntu0.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-40930
• https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4
• https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x
• http://www.openwall.com/lists/oss-security/2026/05/15/21

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write.

Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service.

CWE: CWE-787: Out-of-bounds Write

Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure.

The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation.

FIPS impact: no

As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

Remediation

Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.29 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-63072
• https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756
• https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42
• https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335
• https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a
• https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
• https://openssl-library.org/news/secadv/20260825.txt

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer.

Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service.

CWE: CWE-476: NULL Pointer Dereference

Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted.

This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable.

FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

Remediation

Upgrade Ubuntu:22.04 openssl to version 3.0.2-0ubuntu1.29 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-63076
• https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b
• https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e
• https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259
• https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226
• https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c
• https://openssl-library.org/news/secadv/20260825.txt

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

Remediation

There is no fixed version for Ubuntu:22.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-86145
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf
• http://www.openwall.com/lists/oss-security/2026/09/05/3

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

Remediation

There is no fixed version for Ubuntu:22.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-103111
• https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Remediation

Upgrade Ubuntu:22.04 perl to version 5.34.0-3ubuntu1.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-12087
• https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch
• https://metacpan.org/release/PEVANS/Socket-2.041/changes
• http://www.openwall.com/lists/oss-security/2026/06/15/10

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Remediation

Upgrade Ubuntu:22.04 perl to version 5.34.0-3ubuntu1.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-15534
• https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch
• https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch
• http://www.openwall.com/lists/oss-security/2026/08/09/12
• http://www.openwall.com/lists/oss-security/2026/08/09/13

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.

The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.

Example:

"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed

An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

Remediation

Upgrade Ubuntu:22.04 perl to version 5.34.0-3ubuntu1.9 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-19487
• https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch
• http://www.openwall.com/lists/oss-security/2026/08/13/8
• https://github.com/Perl/perl5/issues/22892

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.

retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.

A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

Remediation

Upgrade Ubuntu:22.04 perl to version 5.34.0-3ubuntu1.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-57433
• https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch
• http://www.openwall.com/lists/oss-security/2026/07/13/7

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

Remediation

Upgrade Ubuntu:22.04 sqlite3 to version 3.37.2-2ubuntu0.8 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-39113
• https://github.com/20000419/CVE-2026-39113
• https://github.com/sqlite/sqlite/blob/169f68ed88b34cb68f720191c64c058f2ccec508/ext/misc/sqlar.c
• https://github.com/sqlite/sqlite/commit/169f68ed88b34cb68f720191c64c058f2ccec508
• https://www.sqlite.org/
• https://www.sqlite.org/sqlar.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

Remediation

Upgrade Ubuntu:22.04 systemd to version 249.11-0ubuntu3.22 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-15059
• https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

Remediation

Upgrade Ubuntu:22.04 systemd to version 249.11-0ubuntu3.22 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-16742
• https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parse_dos_extended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap cur_start + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

Remediation

Upgrade Ubuntu:22.04 util-linux to version 2.37.2-4ubuntu3.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53615
• https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623
• https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31
• https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af
• https://github.com/util-linux/util-linux/releases/tag/v2.41.4
• https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Remediation

Upgrade Ubuntu:22.04 util-linux to version 2.37.2-4ubuntu3.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-27456
• https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4
• https://github.com/util-linux/util-linux/releases/tag/v2.41.4
• https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount(2) path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab user or users entry whose target has an attacker-writable ancestor can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over /etc/sudoers.d, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through /proc/self/fd; the documented legacy fallback without /proc remains affected.

Remediation

Upgrade Ubuntu:22.04 util-linux to version 2.37.2-4ubuntu3.6 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53613
• https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2
• https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0
• https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8
• https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4
• https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec
• https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9
• https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78
• https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5
• https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9
• https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2
• https://github.com/util-linux/util-linux/releases/tag/v2.41.5
• https://github.com/util-linux/util-linux/releases/tag/v2.42.2
• https://github.com/util-linux/util-linux/releases/tag/v2.42.4
• https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g