Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| Launchpad | 2170856 | pftools FTBFS: heap overflow in PrintTSV (pfsearchV3 -o 7) caught by _FORTIFY_SOURCE=3 | pftools |
| Debian | 983955 | teem: ftbfs with -march=x86-64-v3 | teem |
| Debian | 1144920 | libteem-dev: TeemLibraryDepends.cmake points to wrong location | teem |
| CVE | CVE-2026-74225 | U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths f | u-boot u-boot |
| CVE | CVE-2026-74222 | U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data | u-boot u-boot |
| CVE | CVE-2026-74221 | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A mal | u-boot u-boot u-boot |
| CVE | CVE-2026-74220 | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supp | u-boot u-boot u-boot |
| Launchpad | 2170702 | autopkgtest migraphx-cpu-tests fails because test_msgpack is OOM-killed | migraphx |
| Launchpad | 2142874 | cadabra2: FTBFS in Questing | cadabra2 |
| Launchpad | 2170820 | libcufile-13-2 is shipping debian/libcufile-13-1.alternatives | libcufile-13-2 |
| CVE | CVE-2026-81736 | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend dispropo | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-19667 | If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negativ | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-80274 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-77119 | A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged un | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-81563 | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate int | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-78301 | A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-77692 | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing t | bind9 |
| CVE | CVE-2026-19941 | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an u | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-19033 | For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with | bind9 bind9 bind9 bind9 bind9 |
| CVE | CVE-2026-76163 | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an | bind9 |
About
-
Send Feedback to @ubuntu_updates
