Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-85091 | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() o | zlib zlib zlib zlib zlib zlib |
| CVE | CVE-2026-84790 | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | openvpn openvpn openvpn openvpn openvpn openvpn |
| Launchpad | 2145103 | upekts: fingerprint verify always fails on UPEK TouchStrip (0483:2016) | libfprint libfprint |
| CVE | CVE-2024-14029 | Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body a | python-tornado python-tornado |
| CVE | CVE-2026-103263 | Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirmi | python-tornado python-tornado python-tornado python-tornado |
| CVE | CVE-2026-103262 | Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause den | python-tornado python-tornado python-tornado python-tornado |
| CVE | CVE-2026-91992 | Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper s | python-tornado python-tornado python-tornado python-tornado |
| CVE | CVE-2026-91990 | Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_ | python-tornado python-tornado python-tornado python-tornado |
| Debian | 1017064 | lintian: incorrectly complains about adopted-extended-field XB-Ruby-Versions | lintian |
| Debian | 1141065 | lintian: incorrectly complains about adopted-extended-field for derivatives (XS-Debian-Vcs-Browser, XS-Debian-Vcs-Git, XSBC-Original-Maintainer) | lintian |
| Debian | 1029471 | Conflict: unknown-field Go-Import-Path x missing-xs-go-import-path-for-golang-package | lintian |
| Launchpad | 2167987 | lintian: incorrectly complains about adopted-extended-field for derivatives (XS-Debian-Vcs-Browser, XS-Debian-Vcs-Git, XSBC-Original-Maintainer) | lintian |
| Launchpad | 2170614 | gdm3 crash on password field, missing ubuntu-session file on vanilla GNOME system: stonking after upgrade from resolute | gdm3 |
| Debian | 1141228 | lintian: Please use codenames from distro-info-data | distro-info distro-info distro-info lintian |
| Launchpad | 1012459 | carve out distro information from lintian to distro-info-data | distro-info distro-info distro-info lintian |
| CVE | CVE-2026-69184 | c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the | c-ares c-ares c-ares c-ares c-ares c-ares c-ares c-ares |
| CVE | CVE-2026-69186 | c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields bef | c-ares c-ares c-ares c-ares c-ares c-ares |
| Launchpad | 2161203 | vim: Please use distro-info-data instead of hard-coding distro codenames | vim vim |
| CVE | CVE-2026-107705 | Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to o | poppler poppler poppler poppler poppler poppler poppler poppler poppler poppler poppler poppler poppler poppler poppler poppler |
| CVE | CVE-2026-55973 | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the la | unbound unbound unbound unbound |
About
-
Send Feedback to @ubuntu_updates
