UbuntuUpdates.org

Package "u-boot-qemu"

Name: u-boot-qemu

Description:

A boot loader for qemu
Latest version: 2025.10-0ubuntu0.24.04.4
Release: noble (24.04)
Level: security
Repository: main
Head package: u-boot
Homepage: https://www.denx.de/wiki/U-Boot/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "u-boot-qemu"

All arch deb package
APT INSTALL

Other versions of "u-boot-qemu" in Noble

Repository Area Version
base main 2024.01+dfsg-1ubuntu5
updates main 2025.10-0ubuntu0.24.04.4

Changelog

Version: 2025.10-0ubuntu0.24.04.4 2026-10-14 17:07:50 UTC

u-boot (2025.10-0ubuntu0.24.04.4) noble-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow during NFS read reply processing
    - debian/patches/CVE-2026-74220.patch: Bound the length of an NFS read
      reply in net/nfs.c.
    - CVE-2026-74220
  * SECURITY UPDATE: Buffer overflow during NFS readlink reply processing
    - debian/patches/CVE-2026-74221.patch: Bound the length of an NFS
      readlink reply in net/nfs.c.
    - CVE-2026-74221
  * SECURITY UPDATE: Use-after-free during lwIP wget HTTP download
    - debian/patches/CVE-2026-74222.patch: Return ERR_ABRT after aborting
      wget receive in net/lwip/wget.c.
    - CVE-2026-74222
  * SECURITY UPDATE: Out-of-bounds access during DHCPv6 option parsing
    - debian/patches/CVE-2026-74225_1.patch: Bound received DUID option
      lengths in net/dhcpv6.c and net/dhcpv6.h.
    - debian/patches/CVE-2026-74225_2.patch: Add DHCPv6 oversized option
      regression tests in test/dm/eth.c.
    - CVE-2026-74225

 -- Shafayat Hossain Majumder Wed, 07 Oct 2026 16:58:59 -0400
Source diff to previous version
CVE-2026-74220 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supp
CVE-2026-74221 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A mal
CVE-2026-74222 U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data
CVE-2026-74225 U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths f

Version: 2025.10-0ubuntu0.24.04.3 2026-10-07 15:38:18 UTC

u-boot (2025.10-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: Integer overflow in ZFS filesystem metadata parsing
    - debian/patches/CVE-2025-70290.patch: Prevent integer overflow in
      zfs_nvlist_lookup in fs/zfs/zfs.c.
    - CVE-2025-70290
  * SECURITY UPDATE: Integer overflow in ext4 block group descriptor sizing
    - debian/patches/CVE-2025-70293.patch: Prevent integer overflow in
      ext4fs_get_bgdtable in fs/ext4/ext4_write.c.
    - CVE-2025-70293
  * SECURITY UPDATE: Stale IP defragmentation state after datagram reassembly
    - debian/patches/CVE-2026-15390_1.patch: Clear IP defragmentation state
      after returning a complete packet in net/net.c.
    - debian/patches/CVE-2026-15390_2.patch: Add IP defragmentation
      duplicate-fragment regression test in test/dm/Makefile,
      test/dm/net_defrag.c.
    - CVE-2026-15390
  * SECURITY UPDATE: Out-of-bounds write in IP fragment reassembly
    - debian/patches/CVE-2026-71971_1.patch: Fix out-of-bounds write in IP
      fragment reassembly in net/net.c.
    - debian/patches/CVE-2026-71971_2.patch: Add regression test for IP
      reassembly overflow in test/dm/net_defrag.c.
    - CVE-2026-71971

 -- Shafayat Hossain Majumder Thu, 01 Oct 2026 16:02:47 -0400
Source diff to previous version
CVE-2025-70290 An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed
CVE-2025-70293 An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation
CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fra
CVE-2026-71971 U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c

Version: 2025.10-0ubuntu0.24.04.2 2026-02-23 15:07:50 UTC

  u-boot (2025.10-0ubuntu0.24.04.2) noble-security; urgency=medium

  * No-change rebuild into -security pocket.
    - CVE-2024-57254, CVE-2024-57255, CVE-2024-57256, CVE-2024-57257,
      CVE-2024-57258, CVE-2024-57259

 -- Marc Deslauriers <email address hidden> Wed, 11 Feb 2026 13:04:28 -0500
CVE-2024-57254 An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem.
CVE-2024-57255 An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xfffffff
CVE-2024-57256 An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 fil
CVE-2024-57257 A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.
CVE-2024-57258 Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or becaus
CVE-2024-57259 sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing bec


About   -   Send Feedback to @ubuntu_updates