Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-55973 | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the la | unbound |
| CVE | CVE-2026-32665 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new | unbound |
| CVE | CVE-2026-103226 | A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of | ghostscript ghostscript |
| CVE | CVE-2026-101258 | A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitra | ghostscript ghostscript |
| Launchpad | 2171528 | Type 1 font-loader `.forceput` save/restore UAF yields native read/write and controlled dispatch/RCE under `-dSAFER` | ghostscript ghostscript |
| CVE | CVE-2026-81634 | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRS | unbound unbound unbound unbound unbound unbound unbound unbound |
| CVE | CVE-2026-85501 | Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of | unbound unbound unbound unbound unbound unbound unbound unbound |
| CVE | CVE-2026-40691 | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound | unbound unbound unbound unbound unbound unbound unbound unbound |
| CVE | CVE-2026-44690 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during | unbound unbound unbound unbound unbound unbound unbound unbound |
| CVE | CVE-2026-50252 | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the ent | unbound unbound unbound unbound unbound unbound unbound unbound |
| CVE | CVE-2026-80225 | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no | unbound unbound unbound unbound unbound unbound unbound unbound |
| CVE | CVE-2026-94266 | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the U | curl curl curl curl |
| CVE | CVE-2026-92391 | A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An exces | curl curl curl curl |
| CVE | CVE-2026-92390 | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints | curl curl |
| CVE | CVE-2026-92389 | libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for bot | curl curl curl curl |
| CVE | CVE-2026-92388 | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the | curl curl curl curl |
| CVE | CVE-2026-92387 | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its co | curl curl |
| CVE | CVE-2026-92386 | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length | curl curl |
| CVE | CVE-2026-87865 | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a | curl curl |
| CVE | CVE-2026-87864 | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded da | curl curl curl curl |
About
-
Send Feedback to @ubuntu_updates
