Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| Launchpad | 2172897 | haproxy 2.4.30-0ubuntu0.22.04.3: CVE-2026-110354 backport causes intermittent 502 (PH) on valid chunked responses | haproxy haproxy |
| Launchpad | 2172964 | frr: CVE-2024-55553 backport stops RPKI revalidation after the first VRP update (noble, jammy) and breaks the RPKI module (focal ESM) | frr frr frr frr |
| Launchpad | 2165160 | SPF handling in Exim4 incorrectly quotes the email address | exim4 exim4 exim4 exim4 |
| Launchpad | 2167823 | AppArmor denies QEMU to read /sys/devices/pci0000:00/0000:00:01.2/uevent | libvirt-hwe libvirt libvirt-hwe libvirt |
| Launchpad | 2170521 | package tzdata-legacy (not installed) failed to install/upgrade: trying to overwrite '/usr/share/zoneinfo/Asia/Choibalsan', which is also in package | tzdata tzdata |
| CVE | CVE-2026-89147 | Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read | net-snmp net-snmp net-snmp net-snmp net-snmp net-snmp net-snmp net-snmp net-snmp net-snmp net-snmp net-snmp |
| CVE | CVE-2026-59205 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corr | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-59204 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-59203 | Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%B | pillow pillow pillow pillow |
| CVE | CVE-2026-59200 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize se | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-59199 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coo | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-59197 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-55380 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored t | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-55379 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passe | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-54060 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image. | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-54059 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-54058 | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec p | pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow pillow |
| CVE | CVE-2026-106454 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap | twisted twisted twisted twisted twisted twisted twisted twisted |
| CVE | CVE-2026-109518 | On Debian, Ubuntu, and derivative Linux distributions, an on-path atta ... | apt apt apt apt apt apt apt apt apt apt |
| Debian | 1111554 | apt - daily job spams "Tried to start delayed item […], but failed" | apt apt apt apt |
About
-
Send Feedback to @ubuntu_updates
