{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "ca-certificates", "cloud-init", "distro-info-data", "gir1.2-glib-2.0", "libbrotli1", "libglib2.0-0t64", "liblzma5", "ubuntu-pro-client", "xz-utils", "zlib1g" ] } }, "diff": { "deb": [ { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260601~24.04.1", "version": "20260601~24.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.24.04.1", "version": "20260816ubuntu0.24.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2171507 ], "changes": [ { "cves": [], "log": [ "", " * Blacklist the following CA cert due to intermediate cert compromise", " (LP: #2171507)", " + \"emSign ECC Root CA - G3\"", " * Update Mozilla certificate authority bundle to version 2.90", " The following certificate authorities were added (+):", " + \"SECOM TLS ECC Root CA 2024\"", " + \"SECOM TLS RSA Root CA 2024\"", " + \"Telia EC TLS Root CA v3\"", " + \"Telia RSA TLS Root CA v3\"", " The following certificate authorities were removed (-):", " - \"Atos TrustedRoot 2011\"", " - \"Entrust Root Certification Authority\"", " - \"SecureSign Root CA12\"", " - \"ePKI Root Certification Authority\"", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.24.04.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2171507 ], "author": "Marc Deslauriers ", "date": "Tue, 20 Oct 2026 09:03:26 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu1~24.04.1", "version": "26.1-0ubuntu1~24.04.1" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu1~24.04.2", "version": "26.2-0ubuntu1~24.04.2" }, "cves": [], "launchpad_bugs_fixed": [ 2171959, 2164685 ], "changes": [ { "cves": [], "log": [ "", " * Correctly set apt sources for arm64 systems to use ports.ubuntu.com as the", " archive mirror, as archive.ubuntu.com only mirrors arm64 for resolute", " onwards. (LP: #2171959)", " - d/p/retain-arm64-apt-mirrors-revert-archive-ubuntu-com.patch", "" ], "package": "cloud-init", "version": "26.2-0ubuntu1~24.04.2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2171959 ], "author": "Chad Smith ", "date": "Thu, 22 Oct 2026 09:46:26 -0600" }, { "cves": [], "log": [ "", " * d/control: add python3-pyfakefs dependency", " * refresh patches:", " - d/p/0001-Revert-fix-DNS-resolution-performance-regression-dur.patch", " - d/p/no-nocloud-network.patch", " - d/p/no-single-process.patch", " - d/p/retain-setuptools.patch. Use PACKAGED_VERSION environment variable.", " * Upstream snapshot based on upstream/main at 399cc042.", " * refresh patches:", " - d/p/no-nocloud-network.patch", " * Upstream snapshot based on 26.2. (LP: #2164685).", " List of changes from upstream can be found at", " https://raw.githubusercontent.com/canonical/cloud-init/26.2/ChangeLog", "" ], "package": "cloud-init", "version": "26.2-0ubuntu1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2164685 ], "author": "Chad Smith ", "date": "Thu, 20 Aug 2026 15:02:15 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "0.72-0ubuntu0.24.04.1", "version": "0.72-0ubuntu0.24.04.1" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "2026.10.12-0ubuntu0.24.04.1", "version": "2026.10.12-0ubuntu0.24.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2170573 ], "changes": [ { "cves": [], "log": [ "", " * New data update release", " - Correct Debian codename Experimental to RC-Buggy", " - Support testing against the installed data", " - Switch to calendar versioning (CalVer)", " - Add Ubuntu 27.04 \"Tenacious T-Rex\" (LP: #2170573)", " - Makefile: Clean .pyc files and mypy cache", " * Apply patch to revert correcting Debian codename Experimental to RC-Buggy,", " because this change breaks the distro-info test case and dgit (see #2168892)", " * autopkgtest:", " - test against the installed data", " - reduce dependencies to the needed minimum", "" ], "package": "distro-info-data", "version": "2026.10.12-0ubuntu0.24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2170573 ], "author": "Benjamin Drung ", "date": "Mon, 12 Oct 2026 17:34:24 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "gir1.2-glib-2.0", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.9", "version": "2.80.0-6ubuntu3.9" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.10", "version": "2.80.0-6ubuntu3.10" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.80.0-6ubuntu3.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 15:16:18 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbrotli1", "from_version": { "source_package_name": "brotli", "source_package_version": "1.1.0-2build2", "version": "1.1.0-2build2" }, "to_version": { "source_package_name": "brotli", "source_package_version": "1.1.0-2ubuntu0.1", "version": "1.1.0-2ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "medium", "cve_public_date": "2026-10-23" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "medium", "cve_public_date": "2026-10-23" } ], "log": [ "", " * SECURITY UPDATE: DoS or code exec via buffer overflow", " - debian/patches/CVE-2026-111497.patch: Detect and report invalid stream", " earlier. in c/dec/decode.c, c/include/brotli/decode.h.", " - CVE-2026-111497", "" ], "package": "brotli", "version": "1.1.0-2ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Sun, 25 Oct 2026 13:49:57 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-0t64", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.9", "version": "2.80.0-6ubuntu3.9" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.10", "version": "2.80.0-6ubuntu3.10" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.80.0-6ubuntu3.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 15:16:18 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblzma5", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.3", "version": "5.6.1+really5.4.5-1ubuntu0.3" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.4", "version": "5.6.1+really5.4.5-1ubuntu0.4" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.6.1+really5.4.5-1ubuntu0.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:11 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-pro-client", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~24.04.1", "version": "37.2ubuntu~24.04.1" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "38ubuntu0~24.04", "version": "38ubuntu0~24.04" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2131292, 2129712 ], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~24.04.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:28:34 +0200" }, { "cves": [], "log": [ "", " * d/apparmor/ubuntu_pro_esm_cache.jinja2: fix \"DENIED\" messages when", " devicetree exists (LP: #2131292)", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~24.04", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2131292 ], "author": "Renan Rodrigo ", "date": "Tue, 07 Apr 2026 15:21:59 -0300" }, { "cves": [], "log": [ "", " * Backport 37.1ubuntu0 to noble (LP: #2129712)", "" ], "package": "ubuntu-advantage-tools", "version": "37.1ubuntu0~24.04", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2129712 ], "author": "Renan Rodrigo ", "date": "Mon, 27 Oct 2025 09:42:14 -0300" } ], "notes": null, "is_version_downgrade": true }, { "name": "xz-utils", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.3", "version": "5.6.1+really5.4.5-1ubuntu0.3" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.4", "version": "5.6.1+really5.4.5-1ubuntu0.4" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.6.1+really5.4.5-1ubuntu0.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:11 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.2", "version": "1:1.3.dfsg-3.1ubuntu2.2" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.3", "version": "1:1.3.dfsg-3.1ubuntu2.3" }, "cves": [ { "cve": "CVE-2026-85091", "url": "https://ubuntu.com/security/CVE-2026-85091", "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "cve_priority": "medium", "cve_public_date": "2026-09-03 13:06:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-85091", "url": "https://ubuntu.com/security/CVE-2026-85091", "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "cve_priority": "medium", "cve_public_date": "2026-09-03 13:06:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow in gz_vacate() during non-blocking", " gzwrite() operations", " - debian/patches/CVE-2026-85091.patch: reset stale input buffer pointer", " on gz_comp() error in gz_write() in gzwrite.c", " - CVE-2026-85091", "" ], "package": "zlib", "version": "1:1.3.dfsg-3.1ubuntu2.3", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Wed, 21 Oct 2026 16:56:17 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from daily image serial 20261020 to 20261027", "from_series": "noble", "to_series": "noble", "from_serial": "20261020", "to_serial": "20261027", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }