UbuntuUpdates.org

Package "u-boot-qemu"

Name: u-boot-qemu

Description:

A boot loader for qemu
Latest version: 2025.10-0ubuntu6
Release: stonking (26.10)
Level: updates
Repository: main
Head package: u-boot
Homepage: https://www.denx.de/wiki/U-Boot/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "u-boot-qemu"

All arch deb package
APT INSTALL

Other versions of "u-boot-qemu" in Stonking

Repository Area Version
base main 2025.10-0ubuntu5
security main 2025.10-0ubuntu6

Changelog

Version: 2025.10-0ubuntu6 2026-10-21 19:19:52 UTC

u-boot (2025.10-0ubuntu6) stonking; urgency=medium

  * SECURITY UPDATE: Buffer overflow during NFS read reply processing
    - debian/patches/CVE-2026-74220.patch: Bound the length of an NFS read
      reply in net/nfs.c.
    - CVE-2026-74220
  * SECURITY UPDATE: Buffer overflow during NFS readlink reply processing
    - debian/patches/CVE-2026-74221.patch: Bound the length of an NFS
      readlink reply in net/nfs.c.
    - CVE-2026-74221
  * SECURITY UPDATE: Use-after-free during lwIP wget HTTP download
    - debian/patches/CVE-2026-74222.patch: Return ERR_ABRT after aborting
      wget receive in net/lwip/wget.c.
    - CVE-2026-74222
  * SECURITY UPDATE: Out-of-bounds access during DHCPv6 option parsing
    - debian/patches/CVE-2026-74225_1.patch: Bound received DUID option
      lengths in net/dhcpv6.c and net/dhcpv6.h.
    - debian/patches/CVE-2026-74225_2.patch: Add DHCPv6 oversized option
      regression tests in test/dm/eth.c.
    - CVE-2026-74225

 -- Shafayat Hossain Majumder Tue, 20 Oct 2026 11:59:03 -0400
CVE-2026-74220 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supp
CVE-2026-74221 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A mal
CVE-2026-74222 U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data
CVE-2026-74225 U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths f


About   -   Send Feedback to @ubuntu_updates