{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "ca-certificates", "cloud-init", "cloud-init-base", "distro-info-data", "liblzma5", "libpam-systemd", "libsystemd-shared", "libsystemd0", "libudev1", "python3-jwt", "systemd", "systemd-resolved", "systemd-sysv", "ubuntu-pro-client", "udev", "xz-utils", "zlib1g" ] } }, "diff": { "deb": [ { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260601~26.04.1", "version": "20260601~26.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.26.04.1", "version": "20260816ubuntu0.26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2171507 ], "changes": [ { "cves": [], "log": [ "", " * Blacklist the following CA cert due to intermediate cert compromise", " (LP: #2171507)", " + \"emSign ECC Root CA - G3\"", " * Update Mozilla certificate authority bundle to version 2.90", " The following certificate authorities were added (+):", " + \"SECOM TLS ECC Root CA 2024\"", " + \"SECOM TLS RSA Root CA 2024\"", " + \"Telia EC TLS Root CA v3\"", " + \"Telia RSA TLS Root CA v3\"", " The following certificate authorities were removed (-):", " - \"Atos TrustedRoot 2011\"", " - \"Entrust Root Certification Authority\"", " - \"SecureSign Root CA12\"", " - \"ePKI Root Certification Authority\"", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.26.04.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2171507 ], "author": "Marc Deslauriers ", "date": "Tue, 20 Oct 2026 09:03:26 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu3~26.04.1", "version": "26.1-0ubuntu3~26.04.1" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu1~26.04.1", "version": "26.2-0ubuntu1~26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2164685 ], "changes": [ { "cves": [], "log": [ "", " * d/control: add python3-pyfakefs dependency", " * Upstream snapshot based on upstream/main at 399cc042.", " * Upstream snapshot based on 26.2. (LP: #2164685).", " List of changes from upstream can be found at", " https://raw.githubusercontent.com/canonical/cloud-init/26.2/ChangeLog", "" ], "package": "cloud-init", "version": "26.2-0ubuntu1~26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164685 ], "author": "Chad Smith ", "date": "Thu, 20 Aug 2026 14:59:50 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init-base", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.1-0ubuntu3~26.04.1", "version": "26.1-0ubuntu3~26.04.1" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu1~26.04.1", "version": "26.2-0ubuntu1~26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2164685 ], "changes": [ { "cves": [], "log": [ "", " * d/control: add python3-pyfakefs dependency", " * Upstream snapshot based on upstream/main at 399cc042.", " * Upstream snapshot based on 26.2. (LP: #2164685).", " List of changes from upstream can be found at", " https://raw.githubusercontent.com/canonical/cloud-init/26.2/ChangeLog", "" ], "package": "cloud-init", "version": "26.2-0ubuntu1~26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2164685 ], "author": "Chad Smith ", "date": "Thu, 20 Aug 2026 14:59:50 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info-data", "from_version": { "source_package_name": "distro-info-data", "source_package_version": "0.72-0ubuntu0.26.04.1", "version": "0.72-0ubuntu0.26.04.1" }, "to_version": { "source_package_name": "distro-info-data", "source_package_version": "2026.10.12-0ubuntu0.26.04.1", "version": "2026.10.12-0ubuntu0.26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2170573 ], "changes": [ { "cves": [], "log": [ "", " * New data update release", " - Correct Debian codename Experimental to RC-Buggy", " - Support testing against the installed data", " - Switch to calendar versioning (CalVer)", " - Add Ubuntu 27.04 \"Tenacious T-Rex\" (LP: #2170573)", " - Makefile: Clean .pyc files and mypy cache", " * Apply patch to revert correcting Debian codename Experimental to RC-Buggy,", " because this change breaks the distro-info test case and dgit (see #2168892)", " * autopkgtest:", " - test against the installed data", " - reduce dependencies to the needed minimum", "" ], "package": "distro-info-data", "version": "2026.10.12-0ubuntu0.26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2170573 ], "author": "Benjamin Drung ", "date": "Mon, 12 Oct 2026 17:32:19 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblzma5", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1", "version": "5.8.3-1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1ubuntu0.1", "version": "5.8.3-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure LP: #2170056", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c, tests/tests.cmake.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.8.3-1ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:15 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd-shared", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd0", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudev1", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.10.1-4ubuntu1.2", "version": "2.10.1-4ubuntu1.2" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.10.1-4ubuntu1.3", "version": "2.10.1-4ubuntu1.3" }, "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unauthenticated Denial of Service via unbounded thread", " lock waiting during JWKS cache refreshes", " - debian/patches/CVE-2026-101917.patch: Throttle repeated PyJWKClient", " refreshes in jwt/jwks_client.py, tests/test_jwks_client.py.", " - CVE-2026-101917", " * SECURITY UPDATE: Uncaught recursion exception in get_signing_key_from_jwt", " - debian/patches/CVE-2026-101918.patch: fix: normalize recursive JWT ", " payload errors in jwt/api_jwt.py, tests/test_api_jwt.py,", " tests/test_jwks_client.py.", " - CVE-2026-101918", " * SECURITY UPDATE: Uncaught exception in RSAAlgorithm.from_jwk when ", " processing malformed RSA key.", " - debian/patches/CVE-2026-102274.patch: Skip malformed JWKs in JWK sets in", " jwt/api_jwk.py, tests/test_api_jwk.py.", " - CVE-2026-102274", " * SECURITY UPDATE: Public/private key identity confusion via mismatched x ", " and d parameters in OKPAlgorithm.from_jwk", " - debian/patches/CVE-2026-102275.patch: fix: reject inconsistent OKP ", " private keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102275", "" ], "package": "pyjwt", "version": "2.10.1-4ubuntu1.3", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 15 Oct 2026 11:30:55 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-resolved", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-sysv", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-pro-client", "from_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "37.2ubuntu0.1", "version": "37.2ubuntu0.1" }, "to_version": { "source_package_name": "ubuntu-advantage-tools", "source_package_version": "38ubuntu0~26.04", "version": "38ubuntu0~26.04" }, "cves": [ { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2163406, 2153472, 2143251, 2163406, 2144693 ], "changes": [ { "cves": [], "log": [ "", " * Backport 38ubuntu0 to resolute (LP: #2163406)", "" ], "package": "ubuntu-advantage-tools", "version": "38ubuntu0~26.04", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2163406 ], "author": "Spencer Runde ", "date": "Tue, 08 Sep 2026 17:45:13 -0300" }, { "cves": [ { "cve": "CVE-2026-12391", "url": "https://ubuntu.com/security/CVE-2026-12391", "cve_description": "An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-11386", "url": "https://ubuntu.com/security/CVE-2026-11386", "cve_description": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.", "cve_priority": "high", "cve_public_date": "2026-07-16 13:16:00 UTC" }, { "cve": "CVE-2026-9494", "url": "https://ubuntu.com/security/CVE-2026-9494", "cve_description": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.", "cve_priority": "medium", "cve_public_date": "2026-07-16 13:16:00 UTC" } ], "log": [ "", " * d/apparmor/ubuntu_pro_esm_cache.jinja2:", " - fix denied audit messages when devicetree exists (LP #2131292)", " - add cap perfmon to cloud_id AppArmor profile (LP: #2153472)", " - add perfmon systemctl unix socket in AppArmor profiles (LP: #2143251)", " - include PID directory in ubuntu_pro_esm_cache profile", " - allow /usr/share/coreutils/locales/** in ubuntu_pro_esm_cache profile", " * New upstream release 38 (LP: #2163406):", " - security:", " + fix CVE-2026-12391", " + fix CVE-2026-11386", " + fix CVE-2026-9494", " - clouds:", " + add GCP license IDs for Base and Minimal images for resolute", " + add GCP Base Marketplace and Minimal Marketplace license IDs for", " bionic, focal, jammy, noble, and resolute", " + map aws-gov to aws for correct FIPS flavor (LP: #2144693)", "" ], "package": "ubuntu-advantage-tools", "version": "38ubuntu0", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153472, 2143251, 2163406, 2144693 ], "author": "Spencer Runde ", "date": "Fri, 28 Aug 2026 16:09:28 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "udev", "from_version": { "source_package_name": "systemd", "source_package_version": "259.5-0ubuntu3.4", "version": "259.5-0ubuntu3.4" }, "to_version": { "source_package_name": "systemd", "source_package_version": "259.9-0ubuntu0.1", "version": "259.9-0ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167504 ], "changes": [ { "cves": [ { "cve": "CVE-2026-15060", "url": "https://ubuntu.com/security/CVE-2026-15060", "cve_description": "When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-15059", "url": "https://ubuntu.com/security/CVE-2026-15059", "cve_description": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" }, { "cve": "CVE-2026-16742", "url": "https://ubuntu.com/security/CVE-2026-16742", "cve_description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "cve_priority": "medium", "cve_public_date": "2026-08-10 14:17:00 UTC" } ], "log": [ "", " * New upstream version 259.9 (LP: #2167504)", " - d/gbp.conf: set upstream branch to 259.x stable", " - d/watch: track 259.x stable", " - Update upstream source from tag 'upstream/259.9'", " Update to upstream version '259.9'", " with Debian dir 892b1f6f3b4572f8b134ba87f2bf7e1af1884194", " * Drop patches included in new upstream version:", " - CVE-2026-15060.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/93bf2fd1f5", " - lp2148619-units-order-networkd-resolve-hook-After-network-pre.targe.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/55ee2c19a2", " - CVE-2026-15059.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/967850cb99", " - lp2155132-mkosi-trim-verity.sig-json-files-to-remove-NUL-padding-be.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/102a84a914", " - lp2148619-units-drop-Before-sockets.target-from-networkd-resolve-ho.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/479a2dcb12", " - GHSA-5rm9-cc37-35gq.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/958aefc3a5", " - lp2150773-core-Open-netfilter-socket-only-when-needed.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/907f0482ea", " - GHSA-2p9f-rcmv-x36h.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b808894777", " - GHSA-3jgj-3phh-hx5j/resolve-limit-the-number-NTAs-to-something-sensible.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/72c4686786", " - GHSA-3jgj-3phh-hx5j/core-limit-the-number-of-units-that-can-be-requested-over.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/5bbb84ac27", " - GHSA-3jgj-3phh-hx5j/sd-json-limit-the-number-of-env-variables-to-something-re.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/d40943d2b1", " - GHSA-3jgj-3phh-hx5j/dbus-manager-limit-the-number-of-states-patterns-per-quer.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/cb6c3e5bf1", " - GHSA-3jgj-3phh-hx5j/sd-json-user-record-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/b313f7cc8c", " - GHSA-3jgj-3phh-hx5j/sd-bus-store-the-strv-size-when-extending-it.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/3865ea5579", " - GHSA-3jgj-3phh-hx5j/dns-question-limit-the-number-of-questions-per-query.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8bbeac804e", " - GHSA-3jgj-3phh-hx5j/resolve-enforce-the-search-domain-limit-earlier.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/f48ced6cc4", " - GHSA-m8q3-73v4-wvg7.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/8ecee45b24", " - CVE-2026-16742/homed-verify-privileged-worker-changes.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/7de1a48462", " - CVE-2026-16742/homed-fix-verification-of-local-identity-file.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/4365d4a3b7", " - GHSA-3jgj-3phh-hx5j/dbus-limit-the-number-of-env-variables-to-something-reaso.patch.", " Applied upstream: https://github.com/systemd/systemd/commit/271071eaa1", " - lp2145027/ssh-proxy-return-an-error-if-user-supplies-VMADDR_CID_ANY.patch", " Applied upstream: https://github.com/systemd/systemd/commit/6f5de2b522", " * New changes:", " - d/udev.install: install hwdb shell completion", " - d/systemd.manpages: install missing manpages", "" ], "package": "systemd", "version": "259.9-0ubuntu0.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2167504 ], "author": "Nick Rosbrook ", "date": "Wed, 16 Sep 2026 10:55:31 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "xz-utils", "from_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1", "version": "5.8.3-1" }, "to_version": { "source_package_name": "xz-utils", "source_package_version": "5.8.3-1ubuntu0.1", "version": "5.8.3-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 2170056 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: invalid memory write during decoder reinitialization", " after allocation failure LP: #2170056", " - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()", " safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.", " - debian/patches/LP-2170056_2.patch: Clean up after a filter chain", " initialization error in src/liblzma/common/alone_decoder.c,", " src/liblzma/common/lzip_decoder.c,", " src/liblzma/common/microlzma_decoder.c.", " - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse", " after dictionary allocation failure in tests/Makefile.am,", " tests/test_alone_decoder.c, tests/tests.cmake.", " - No CVE number", "" ], "package": "xz-utils", "version": "5.8.3-1ubuntu0.1", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2170056 ], "author": "Shafayat Hossain Majumder ", "date": "Fri, 09 Oct 2026 11:54:15 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg+really1.3.1-1ubuntu3.1", "version": "1:1.3.dfsg+really1.3.1-1ubuntu3.1" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg+really1.3.1-1ubuntu3.2", "version": "1:1.3.dfsg+really1.3.1-1ubuntu3.2" }, "cves": [ { "cve": "CVE-2026-85091", "url": "https://ubuntu.com/security/CVE-2026-85091", "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "cve_priority": "medium", "cve_public_date": "2026-09-03 13:06:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-85091", "url": "https://ubuntu.com/security/CVE-2026-85091", "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "cve_priority": "medium", "cve_public_date": "2026-09-03 13:06:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow in gz_vacate() during non-blocking", " gzwrite() operations", " - debian/patches/CVE-2026-85091.patch: reset stale input buffer pointer", " on gz_comp() error in gz_write() in gzwrite.c", " - CVE-2026-85091", "" ], "package": "zlib", "version": "1:1.3.dfsg+really1.3.1-1ubuntu3.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Wed, 21 Oct 2026 16:56:20 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.04 resolute image from release image serial 20261017 to 20261024", "from_series": "resolute", "to_series": "resolute", "from_serial": "20261017", "to_serial": "20261024", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }