{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "ca-certificates", "cloud-init", "distro-info-data", "gir1.2-glib-2.0", "libbrotli1", "libglib2.0-0t64", "liblzma5", "python3-jwt", "ubuntu-pro-client", "xz-utils", "zlib1g" ] } }, "diff": { "deb": [ { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260601~24.04.1", "version": "20260601~24.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.24.04.1", "version": "20260816ubuntu0.24.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2171507 ], "changes": [ { "cves": [], "log": [ "", " * Blacklist the following CA cert due to intermediate cert compromise", " (LP: #2171507)", " + \"emSign ECC Root CA - G3\"", " * Update Mozilla certificate authority bundle to version 2.90", " The following certificate authorities were added (+):", " + \"SECOM TLS ECC Root CA 2024\"", " + \"SECOM TLS RSA Root CA 2024\"", " + \"Telia EC TLS Root CA v3\"", " + \"Telia RSA TLS Root CA v3\"", " The following certificate authorities were removed (-):", " - \"Atos TrustedRoot 2011\"", " - \"Entrust Root Certification Authority\"", " - \"SecureSign Root CA12\"", " - \"ePKI Root Certification Authority\"", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.24.04.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2171507 ], "author": "Marc Deslauriers ", "date": "Tue, 20 Oct 2026 09:03:26 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu1~24.04.1", "version": "26.1-0ubuntu1~24.04.1" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu1~24.04.2", "version": "26.2-0ubuntu1~24.04.2" }, "cves": [], "launchpad_bugs_fixed": [ 2171959, 2164685 ], "changes": [ { "cves": [], "log": [ "", " * Correctly set apt sources for arm64 systems to use ports.ubuntu.com as the", " archive mirror, as archive.ubuntu.com only mirrors arm64 for resolute", " onwards. (LP: #2171959)", " - d/p/retain-arm64-apt-mirrors-revert-archive-ubuntu-com.patch", "" ], "package": "cloud-init", "version": "26.2-0ubuntu1~24.04.2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2171959 ], "author": "Chad Smith ", "date": "Thu, 22 Oct 2026 09:46:26 -0600" }, { "cves": [], "log": [ "", " * d/control: add python3-pyfakefs dependency", " * refresh patches:", " - d/p/0001-Revert-fix-DNS-resolution-performance-regression-dur.patch", " - d/p/no-nocloud-network.patch", " - d/p/no-single-process.patch", " - d/p/retain-setuptools.patch. Use PACKAGED_VERSION environment variable.", " * Upstream snapshot based on upstream/main at 399cc042.", " * refresh patches:", " - d/p/no-nocloud-network.patch", " * Upstream snapshot based on 26.2. (LP: #2164685).", " List of changes from upstream can be found at", " https://raw.githubusercontent.com/canonical/cloud-init/26.2/ChangeLog", "" ], "package": "cloud-init", "version": "26.2-0ubuntu1~24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2164685 ], "author": "Chad Smith ", "date": "Thu, 20 Aug 2026 15:02:15 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "0.72-0ubuntu0.24.04.1", "version": "0.72-0ubuntu0.24.04.1" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "2026.10.12-0ubuntu0.24.04.1", "version": "2026.10.12-0ubuntu0.24.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2170573 ], "changes": [ { "cves": [], "log": [ "", " * New data update release", " - Correct Debian codename Experimental to RC-Buggy", " - Support testing against the installed data", " - Switch to calendar versioning (CalVer)", " - Add Ubuntu 27.04 \"Tenacious T-Rex\" (LP: #2170573)", " - Makefile: Clean .pyc files and mypy cache", " * Apply patch to revert correcting Debian codename Experimental to RC-Buggy,", " because this change breaks the distro-info test case and dgit (see #2168892)", " * autopkgtest:", " - test against the installed data", " - reduce dependencies to the needed minimum", "" ], "package": "distro-info-data", "version": "2026.10.12-0ubuntu0.24.04.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2170573 ], "author": "Benjamin Drung ", "date": "Mon, 12 Oct 2026 17:34:24 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "gir1.2-glib-2.0", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.9", "version": "2.80.0-6ubuntu3.9" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.10", "version": "2.80.0-6ubuntu3.10" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.80.0-6ubuntu3.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 15:16:18 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbrotli1", "from_version": { "source_package_name": "brotli", "source_package_version": "1.1.0-2build2", "version": "1.1.0-2build2" }, "to_version": { "source_package_name": "brotli", "source_package_version": "1.1.0-2ubuntu0.1", "version": "1.1.0-2ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "medium", "cve_public_date": "2026-10-23" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "medium", "cve_public_date": "2026-10-23" } ], "log": [ "", " * SECURITY UPDATE: DoS or code exec via buffer overflow", " - debian/patches/CVE-2026-111497.patch: Detect and report invalid stream", " earlier. in c/dec/decode.c, c/include/brotli/decode.h.", " - CVE-2026-111497", "" ], "package": "brotli", "version": "1.1.0-2ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Sun, 25 Oct 2026 13:49:57 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libglib2.0-0t64", "from_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.9", "version": "2.80.0-6ubuntu3.9" }, "to_version": { "source_package_name": "glib2.0", "source_package_version": "2.80.0-6ubuntu3.10", "version": "2.80.0-6ubuntu3.10" }, "cves": [], "launchpad_bugs_fixed": [ 2165869 ], "changes": [ { "cves": [], "log": [ "", " * Fix program lockups due to thread pool exhaustion in GTask (LP: #2165869)", " - d/p/lp2165869-fix-gtask-run-in-thread.patch", "" ], "package": "glib2.0", "version": "2.80.0-6ubuntu3.10", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2165869 ], "author": "Alex Ramírez ", "date": "Wed, 23 Sep 2026 15:16:18 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblzma5", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.3", "version": "5.6.1+really5.4.5-1ubuntu0.3" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.4", "version": "5.6.1+really5.4.5-1ubuntu0.4" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.6.1+really5.4.5-1ubuntu0.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:11 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.7.0-1ubuntu0.3", "version": "2.7.0-1ubuntu0.3" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.7.0-1ubuntu0.4", "version": "2.7.0-1ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unauthenticated Denial of Service via unbounded thread", " lock waiting during JWKS cache refreshes", " - debian/patches/CVE-2026-101917.patch: Throttle repeated PyJWKClient", " refreshes in jwt/jwks_client.py, tests/test_jwks_client.py.", " - CVE-2026-101917", " * SECURITY UPDATE: Uncaught recursion exception in get_signing_key_from_jwt", " - debian/patches/CVE-2026-101918.patch: fix: normalize recursive JWT ", " payload errors in jwt/api_jwt.py, tests/test_api_jwt.py,", " tests/test_jwks_client.py.", " - CVE-2026-101918", " * SECURITY UPDATE: Uncaught exception in RSAAlgorithm.from_jwk when ", " processing malformed RSA key.", " - debian/patches/CVE-2026-102274.patch: Skip malformed JWKs in JWK sets in", " jwt/api_jwk.py, tests/test_api_jwk.py.", " - CVE-2026-102274", " * SECURITY UPDATE: Public/private key identity confusion via mismatched x ", " and d parameters in OKPAlgorithm.from_jwk", " - debian/patches/CVE-2026-102275.patch: fix: reject inconsistent OKP ", " private keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102275", "" ], "package": "pyjwt", "version": "2.7.0-1ubuntu0.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 15 Oct 2026 12:30:42 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-pro-client", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu~24.04.1", "version": "37.2ubuntu~24.04.1" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "38ubuntu0~24.04", "version": "38ubuntu0~24.04" }, "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2131292, 2129712 ], "changes": [ { "cves": [ { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information disclosure", " - Remove credentials out of argv into apt's own auth.conf.d facility.", " - CVE-2026-9494", " * SECURITY UPDATE: Improper input validation", " - enforce StrictStringDataValue to applicable fields in directives", " - reject newline, carriage return, spaces, and shell meta characters", " in StrictStringDataValue", " - CVE-2026-11386", " * SECURITY UPDATE: Symlink attack", " - reject symlink log files in user-controlled directory trees during", " pro collect-logs", " - restrict pro collect-logs generated support archive permission to", " root only", " - CVE-2026-12391", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~24.04.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Eduardo Barretto ", "date": "Mon, 06 Jul 2026 15:28:34 +0200" }, { "cves": [], "log": [ "", " * d/apparmor/ubuntu_pro_esm_cache.jinja2: fix \"DENIED\" messages when", " devicetree exists (LP: #2131292)", "" ], "package": "ubuntu-advantage-tools", "version": "37.2ubuntu~24.04", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2131292 ], "author": "Renan Rodrigo ", "date": "Tue, 07 Apr 2026 15:21:59 -0300" }, { "cves": [], "log": [ "", " * Backport 37.1ubuntu0 to noble (LP: #2129712)", "" ], "package": "ubuntu-advantage-tools", "version": "37.1ubuntu0~24.04", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2129712 ], "author": "Renan Rodrigo ", "date": "Mon, 27 Oct 2025 09:42:14 -0300" } ], "notes": null, "is_version_downgrade": true }, { "name": "xz-utils", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.3", "version": "5.6.1+really5.4.5-1ubuntu0.3" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.6.1+really5.4.5-1ubuntu0.4", "version": "5.6.1+really5.4.5-1ubuntu0.4" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure (LP: #2170056)", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.6.1+really5.4.5-1ubuntu0.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:11 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.2", "version": "1:1.3.dfsg-3.1ubuntu2.2" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.3", "version": "1:1.3.dfsg-3.1ubuntu2.3" }, "cves": [ { "cve": "CVE-2026-85091", "url": "https://ubuntu.com/security/CVE-2026-85091", "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "cve_priority": "medium", "cve_public_date": "2026-09-03 13:06:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-85091", "url": "https://ubuntu.com/security/CVE-2026-85091", "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "cve_priority": "medium", "cve_public_date": "2026-09-03 13:06:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow in gz_vacate() during non-blocking", " gzwrite() operations", " - debian/patches/CVE-2026-85091.patch: reset stale input buffer pointer", " on gz_comp() error in gz_write() in gzwrite.c", " - CVE-2026-85091", "" ], "package": "zlib", "version": "1:1.3.dfsg-3.1ubuntu2.3", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Wed, 21 Oct 2026 16:56:17 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from release image serial 20261017 to 20261027", "from_series": "noble", "to_series": "noble", "from_serial": "20261017", "to_serial": "20261027", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }