Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| Launchpad | 2166733 | New upstream core24.60 release | linux-main-modules-vmware linux-main-generate-vmware |
| CVE | CVE-2026-49017 | In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The S | swift swift |
| CVE | CVE-2026-8286 | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS | curl curl |
| CVE | CVE-2026-6429 | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the f | curl curl curl curl |
| CVE | CVE-2026-8458 | libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different | curl curl curl curl curl curl |
| CVE | CVE-2026-11856 | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a diff | curl curl |
| CVE | CVE-2026-8927 | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentic | curl curl curl curl curl curl |
| CVE | CVE-2026-9080 | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts | curl curl |
| CVE | CVE-2026-82209 | When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domai | curl curl curl curl curl curl |
| CVE | CVE-2026-80255 | A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes cur | curl curl |
| CVE | CVE-2026-80230 | When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL | curl curl curl curl curl curl |
| CVE | CVE-2026-80229 | When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider con | curl curl |
| CVE | CVE-2026-18924 | A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-af | curl curl curl curl curl curl |
| CVE | CVE-2026-13608 | A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptogra | curl curl curl curl |
| Launchpad | 2167779 | Reverted security upload 8.20.0-2ubuntu4, broken checksrc and CVE-2026-8927 backport | curl curl curl curl curl curl |
| Launchpad | 2167969 | Upstream update to CVE-2026-9080 fix missing in Resolute | curl curl |
| Launchpad | 2167418 | [SRU] mutter: fullscreen applications run below the display refresh rate | mutter mutter |
| Launchpad | 2083548 | apparmor transmission-daemon | apparmor apparmor |
| Launchpad | 2161023 | [SRU] Enable support for Hibiscus Cloud Archive | software-properties software-properties |
| Launchpad | 2156069 | software-properties-gtk is mostly untranslated | software-properties software-properties |
About
-
Send Feedback to @ubuntu_updates
