UbuntuUpdates.org

Latest Changelogs for all releases

All releases Jammy Noble Plucky Resolute
Include all PPAs Exclude daily builds PPAs Exclude all PPAs
Include levels: securityupdatesproposedbackportsbase

Note: Only updates for "head" packages where the changelog is available are shown on this page (view all).

libssh Aug 31st 13:07
Release: jammy Repo: main Level: security New version: 0.9.6-2ubuntu0.22.04.8
Packages in group:  libssh-4 libssh-dev libssh-doc libssh-gcrypt-4 libssh-gcrypt-dev

libssh (0.9.6-2ubuntu0.22.04.8) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service via zero advertised channel packet size
    - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max
      packet size 0 in src/channels.c, src/messages.c.
    - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size
      in channel open is rejected in tests/unittests/torture_channel.c.
    - CVE-2026-59843
  * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure
    - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return
      code in src/socket.c.
    - CVE-2026-59845
  * SECURITY UPDATE: Information disclosure via ProxyCommand %r username
    expansion
    - debian/patches/CVE-2026-59846-pre1.patch: misc: Add function to check
      username syntax in include/libssh/misc.h, src/misc.c,
      tests/unittests/torture_misc.c.
    - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from
      usernames in include/libssh/priv.h, src/misc.c.
    - CVE-2026-59846
  * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification
    - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of
      AES-GCM ciphers in src/libcrypto.c.
    - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue
      during encryption in src/libcrypto.c.
    - CVE-2026-59847
  * SECURITY UPDATE: Denial of service via SFTP responses with unknown request
    IDs
    - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown
      request IDs in include/libssh/sftp.h, src/sftp.c,
      tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.
    - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue
      ptr in sftp_free in src/sftp.c.
    - CVE-2026-59848
  * SECURITY UPDATE: Use-after-free via data callbacks on closed channels
    - debian/patches/CVE-2026-59850.patch: channels: Avoid processing DATA
      packets on closed channels in src/channels.c.
    - CVE-2026-59850

 -- Marc Deslauriers Mon, 24 Aug 2026 11:20:14 -0400
CVE-2026-59843 A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel write
CVE-2026-59845 A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then b
CVE-2026-59846 A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment v
CVE-2026-59847 A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, al
CVE-2026-59848 A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing
More...

mysql-8.0 Aug 31st 13:07
Release: jammy Repo: main Level: security New version: 8.0.46-0ubuntu0.22.04.4
Packages in group:  libmysqlclient21 libmysqlclient-dev mysql-client mysql-client-8.0 mysql-client-core-8.0 mysql-server mysql-server-8.0 mysql-server-core-8.0

mysql-8.0 (8.0.46-0ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: July 2026 security issues
    - debian/patches/2026-07-security.patch
    - CVE-2026-46936, CVE-2026-47012, CVE-2026-47023, CVE-2026-47052,
      CVE-2026-47064, CVE-2026-60145, CVE-2026-60163, CVE-2026-60177,
      CVE-2026-60178, CVE-2026-60182, CVE-2026-60183, CVE-2026-60184,
      CVE-2026-60185, CVE-2026-60186, CVE-2026-60187, CVE-2026-60188,
      CVE-2026-60189, CVE-2026-60190, CVE-2026-60191, CVE-2026-60315,
      CVE-2026-60316, CVE-2026-60331, CVE-2026-60332, CVE-2026-60585,
      CVE-2026-60747, CVE-2026-61081, CVE-2026-61094, CVE-2026-61096,
      CVE-2026-61109

 -- Marc Deslauriers Wed, 26 Aug 2026 08:43:05 -0400
CVE-2026-46936 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Se
CVE-2026-47012 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are My
CVE-2026-47023 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are
CVE-2026-47052 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:
CVE-2026-47064 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are My
More...

coreutils Aug 31st 13:07
Release: jammy Repo: main Level: security New version: 8.32-4.1ubuntu1.4
Packages in group: 

coreutils (8.32-4.1ubuntu1.4) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read in sort
    - debian/patches/CVE-2025-5278.patch: sort: fix buffer under-read in
      src/sort.c, tests/local.mk, tests/misc/sort-field-limit.sh,
      Makefile.in.
    - CVE-2025-5278

 -- Marc Deslauriers Tue, 25 Aug 2026 11:12:51 -0400
CVE-2025-5278 A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory ou

bind9 Aug 31st 12:07
Release: resolute Repo: main Level: security New version: 1:9.20.24-1ubuntu0.3
Packages in group:  bind9-dev bind9-dnsutils bind9-doc bind9-host bind9-libs bind9-utils

bind9 (1:9.20.24-1ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3
    both present
    - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could
      find unsigned NSEC/NSEC3 in lib/dns/qpcache.c, lib/dns/rbtdb.c,
      lib/dns/rdatalist.c, lib/dns/resolver.c, lib/ns/query.c.
    - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname
      mismatch in
      bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,
      bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,
      bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests
      /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_
      runtime_check.py.
    - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,
      bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/
      system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-13204

 -- Marc Deslauriers Thu, 27 Aug 2026 10:09:09 -0400
CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B

bind9 Aug 31st 12:07
Release: noble Repo: universe Level: security New version: 1:9.18.39-0ubuntu0.24.04.7
Packages in group:  bind9utils dnsutils

bind9 (1:9.18.39-0ubuntu0.24.04.7) noble-security; urgency=medium

  * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3
    both present
    - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could
      find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,
      lib/dns/resolver.c, lib/ns/query.c.
    - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname
      mismatch in
      bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,
      bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,
      bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests
      /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_
      runtime_check.py.
    - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,
      bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/
      system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-13204

 -- Marc Deslauriers Thu, 27 Aug 2026 10:10:14 -0400
CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B

bind-dyndb-ldap Aug 31st 12:07
Release: noble Repo: universe Level: security New version: 11.10-6ubuntu11.24.04.8
Packages in group:  bind9-dyndb-ldap

bind-dyndb-ldap (11.10-6ubuntu11.24.04.8) noble-security; urgency=medium

  * No change rebuild with bind9-libs 1:9.18.39-0ubuntu0.24.04.7

 -- Marc Deslauriers Thu, 27 Aug 2026 11:23:03 -0400

bind9 Aug 31st 12:07
Release: noble Repo: main Level: security New version: 1:9.18.39-0ubuntu0.24.04.7
Packages in group:  bind9-dev bind9-dnsutils bind9-doc bind9-host bind9-libs bind9-utils

bind9 (1:9.18.39-0ubuntu0.24.04.7) noble-security; urgency=medium

  * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3
    both present
    - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could
      find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,
      lib/dns/resolver.c, lib/ns/query.c.
    - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname
      mismatch in
      bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,
      bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,
      bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests
      /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_
      runtime_check.py.
    - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,
      bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/
      system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-13204

 -- Marc Deslauriers Thu, 27 Aug 2026 10:10:14 -0400
CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B

bind9 Aug 31st 12:07
Release: jammy Repo: universe Level: security New version: 1:9.18.39-0ubuntu0.22.04.6
Packages in group:  bind9utils dnsutils

bind9 (1:9.18.39-0ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3
    both present
    - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could
      find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,
      lib/dns/resolver.c, lib/ns/query.c.
    - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname
      mismatch in
      bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,
      bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,
      bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests
      /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_
      runtime_check.py.
    - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,
      bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/
      system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-13204

 -- Marc Deslauriers Thu, 27 Aug 2026 10:11:12 -0400
CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B

bind-dyndb-ldap Aug 31st 12:07
Release: jammy Repo: universe Level: security New version: 11.9-5ubuntu0.22.04.17
Packages in group:  bind9-dyndb-ldap

bind-dyndb-ldap (11.9-5ubuntu0.22.04.17) jammy-security; urgency=medium

  * No change rebuild with bind9-libs 1:9.18.39-0ubuntu0.22.04.6

 -- Marc Deslauriers Thu, 27 Aug 2026 11:24:02 -0400

bind9 Aug 31st 12:07
Release: jammy Repo: main Level: security New version: 1:9.18.39-0ubuntu0.22.04.6
Packages in group:  bind9-dev bind9-dnsutils bind9-doc bind9-host bind9-libs bind9-utils

bind9 (1:9.18.39-0ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3
    both present
    - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could
      find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,
      lib/dns/resolver.c, lib/ns/query.c.
    - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname
      mismatch in
      bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,
      bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,
      bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests
      /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_
      runtime_check.py.
    - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,
      bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/
      system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-13204

 -- Marc Deslauriers Thu, 27 Aug 2026 10:11:12 -0400
CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B

openjdk-25-crac Aug 31st 11:07
Release: resolute Repo: universe Level: security New version: 25.0.4+7-0ubuntu1~26.04
Packages in group:  openjdk-25-crac-dbg openjdk-25-crac-demo openjdk-25-crac-doc openjdk-25-crac-jdk openjdk-25-crac-jdk-headless openjdk-25-crac-jre openjdk-25-crac-jre-headless openjdk-25-crac-jre-zero openjdk-25-crac-source openjdk-25-crac-testsupport

openjdk-25-crac (25.0.4+7-0ubuntu1~26.04) resolute-security; urgency=medium

  * Upload to Ubuntu 26.04.

openjdk-21-crac Aug 31st 11:07
Release: resolute Repo: universe Level: security New version: 21.0.12+8-0ubuntu1~26.04
Packages in group:  openjdk-21-crac-dbg openjdk-21-crac-demo openjdk-21-crac-doc openjdk-21-crac-jdk openjdk-21-crac-jdk-headless openjdk-21-crac-jre openjdk-21-crac-jre-headless openjdk-21-crac-jre-zero openjdk-21-crac-source openjdk-21-crac-testsupport

openjdk-21-crac (21.0.12+8-0ubuntu1~26.04) resolute-security; urgency=medium

  * Upload to Ubuntu 26.04.

openjdk-17-crac Aug 31st 11:07
Release: resolute Repo: universe Level: security New version: 17.0.20+8-0ubuntu1~26.04
Packages in group:  openjdk-17-crac-dbg openjdk-17-crac-demo openjdk-17-crac-doc openjdk-17-crac-jdk openjdk-17-crac-jdk-headless openjdk-17-crac-jre openjdk-17-crac-jre-headless openjdk-17-crac-jre-zero openjdk-17-crac-source

openjdk-17-crac (17.0.20+8-0ubuntu1~26.04) resolute-security; urgency=medium

  * Upload to Ubuntu 26.04.

crac-criu Aug 31st 11:07
Release: resolute Repo: universe Level: security New version: 4.2.1-0ubuntu1~26.04
Packages in group: 

crac-criu (4.2.1-0ubuntu1~26.04) resolute-security; urgency=medium

  * Upload to Ubuntu 26.04.

diffutils Aug 31st 11:07
Release: resolute Repo: main Level: security New version: 1:3.12-1ubuntu0.1
Packages in group:  diffutils-doc

diffutils (1:3.12-1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Integer Overflow
    - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows
      when reading line numbers from diff in NEWS, THANKS, src/diff3.c.
    - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line
      offsets in src/diff3.c.
    - CVE-2026-53910

 -- John Breton Wed, 26 Aug 2026 14:14:58 -0400
CVE-2026-53910 diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. In


About   -   Send Feedback to @ubuntu_updates