UbuntuUpdates.org

Bugs addressed in recent updates

All Launchpad Ubuntu Debian CVE

Origin Bug number Title Packages
CVE CVE-2026-7568 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metap php8.5 php8.5 php8.4 php8.4 php8.3 php8.3 php8.1 php8.1
CVE CVE-2026-7263 In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked li php8.5 php8.5
CVE CVE-2026-7262 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, t php8.5 php8.5 php8.4 php8.4 php8.3 php8.3 php8.1 php8.1
CVE CVE-2026-7261 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSIS php8.5 php8.5 php8.4 php8.4 php8.3 php8.3 php8.1 php8.1
CVE CVE-2026-7259 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma php8.5 php8.5 php8.4 php8.4 php8.3 php8.3 php8.1 php8.1
CVE CVE-2026-7258 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass si php8.5 php8.5 php8.4 php8.4 php8.3 php8.3
CVE CVE-2026-6735 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows php8.5 php8.5 php8.4 php8.4 php8.3 php8.3 php8.1 php8.1
CVE CVE-2026-6722 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mech php8.5 php8.5 php8.4 php8.4 php8.3 php8.3 php8.1 php8.1
CVE CVE-2026-6104 In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() php8.5 php8.5 php8.4 php8.4
CVE CVE-2025-14179 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL php8.5 php8.5 php8.4 php8.4 php8.3 php8.3 php8.1 php8.1
CVE CVE-2026-44742 Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2 postorius postorius postorius postorius
CVE CVE-2026-46470 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function d gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0
CVE CVE-2026-46469 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function d gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0
CVE CVE-2026-47784 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_u memcached memcached memcached memcached memcached memcached memcached memcached
CVE CVE-2026-47783 In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid memcached memcached memcached memcached memcached memcached memcached memcached
CVE CVE-2026-4778 A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_category. memcached memcached memcached memcached memcached memcached memcached memcached
CVE CVE-2026-42046 libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca libcaca
CVE CVE-2026-41990 Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data. libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20
CVE CVE-2026-41989 Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt. libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20 libgcrypt20
Launchpad 2152282 [SRU] Ubuntu 26.04 / Settings crashes when accessing \ malcontent malcontent



About   -   Send Feedback to @ubuntu_updates