UbuntuUpdates.org

Latest Changelogs for all releases

All releases Jammy Noble Plucky Resolute
Include all PPAs Exclude daily builds PPAs Exclude all PPAs
Include levels: securityupdatesproposedbackportsbase

Note: Only updates for "head" packages where the changelog is available are shown on this page (view all).

attr Aug 31st 11:07
Release: resolute Repo: main Level: security New version: 1:2.5.2-4ubuntu0.1
Packages in group:  libattr1 libattr1-dev

attr (1:2.5.2-4ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Symlink Traversal
    - d/p/upstream/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add
      visibility attribute header in include/Makemodule.am, include/visibility-
      hidden.h.
    - d/p/upstream/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add
      xattrat syscall wrappers in configure.ac, include/Makemodule.am,
      include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.
    - d/p/upstream/CVE-2026-54371-03-add-xattrat-syscall-backwards-
      compatibility-code.patch: Add xattrat syscall backwards compatibility code
      in include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,
      libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-
      self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,
      libmisc/setxattrat_compat.c.
    - d/p/upstream/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch:
      Rename walk_tree to old_walk_tree in include/Makemodule.am,
      include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,
      tools/getfattr.c.
    - d/p/upstream/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the
      new walk_tree helper in include/Makemodule.am, include/walk_tree.h,
      libmisc/Makemodule.am, libmisc/walk_tree.c.
    - debian/patches/upstream/CVE-2026-54371-06-harden-getfattr.patch: harden
      getfattr in man/man1/getfattr.1, tools/getfattr.c,
      test/root/getfattr.test.
    - d/p/upstream/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-
      buffer.patch: setfattr: multiple --restore accesses freed buffer in
      tools/setfattr.c.
    - d/p/upstream/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-
      after-restore.patch: setfattr: Do not ignore --no-dereference after
      --restore in tools/setfattr.c.
    - d/p/upstream/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add
      openat2 syscall wrapper in configure.ac, include/Makemodule.am,
      include/openat2.h, libmisc/Makemodule.am, libmisc/openat2.c.
    - d/p/upstream/CVE-2026-54371-10-harden-setfattr-restore.patch: harden
      setfattr --restore in configure.ac, man/man1/setfattr.1,
      test/Makemodule.am, tools/setfattr.c, test/restore.test.
    - CVE-2026-54371

 -- John Breton Sun, 23 Aug 2026 21:34:50 -0400

 (See more...)
CVE-2026-54371 attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate p

diffutils Aug 31st 11:07
Release: noble Repo: main Level: security New version: 1:3.10-1ubuntu0.1
Packages in group:  diffutils-doc

diffutils (1:3.10-1ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: Integer Overflow
    - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows
      when reading line numbers from diff in NEWS, THANKS, src/diff3.c.
    - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line
      offsets in src/diff3.c.
    - CVE-2026-53910

 -- John Breton Wed, 26 Aug 2026 14:15:46 -0400
CVE-2026-53910 diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. In

attr Aug 31st 11:07
Release: noble Repo: main Level: security New version: 1:2.5.2-1ubuntu0.1
Packages in group:  libattr1 libattr1-dev

attr (1:2.5.2-1ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: Symlink Traversal
    - d/p/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add
      visibility attribute header in include/Makemodule.am, include/visibility-
      hidden.h.
    - d/p/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add xattrat
      syscall wrappers in configure.ac, include/Makemodule.am,
      include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.
    - d/p/CVE-2026-54371-03-add-xattrat-syscall-backwards-compatibility-
      code.patch: Add xattrat syscall backwards compatibility code in
      include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,
      libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-
      self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,
      libmisc/setxattrat_compat.c.
    - d/p/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch: Rename
      walk_tree to old_walk_tree in include/Makemodule.am,
      include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,
      tools/getfattr.c.
    - d/p/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the new
      walk_tree helper in include/Makemodule.am, include/walk_tree.h,
      libmisc/Makemodule.am, libmisc/walk_tree.c.
    - debian/patches/CVE-2026-54371-06-harden-getfattr.patch: harden getfattr in
      man/man1/getfattr.1, tools/getfattr.c, test/root/getfattr.test.
    - d/p/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-
      buffer.patch: setfattr: multiple --restore accesses freed buffer in
      tools/setfattr.c.
    - d/p/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-after-
      restore.patch: setfattr: Do not ignore --no-dereference after --restore in
      tools/setfattr.c.
    - d/p/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add openat2
      syscall wrapper in configure.ac, include/Makemodule.am, include/openat2.h,
      libmisc/Makemodule.am, libmisc/openat2.c.
    - debian/patches/CVE-2026-54371-10-harden-setfattr-restore.patch: harden
      setfattr --restore in configure.ac, man/man1/setfattr.1,
      test/Makemodule.am, tools/setfattr.c, test/restore.test.
    - CVE-2026-54371

 -- John Breton Sun, 23 Aug 2026 21:39:46 -0400

 (See more...)
CVE-2026-54371 attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate p

diffutils Aug 31st 11:07
Release: jammy Repo: main Level: security New version: 1:3.8-0ubuntu2.1
Packages in group:  diffutils-doc

diffutils (1:3.8-0ubuntu2.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Integer Overflow
    - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows
      when reading line numbers from diff in NEWS, THANKS, src/diff3.c.
    - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line
      offsets in src/diff3.c.
    - CVE-2026-53910

 -- John Breton Wed, 26 Aug 2026 14:17:15 -0400
CVE-2026-53910 diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. In

attr Aug 31st 11:07
Release: jammy Repo: main Level: security New version: 1:2.5.1-1ubuntu0.1
Packages in group:  libattr1 libattr1-dev

attr (1:2.5.1-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Symlink Traversal
    - d/p/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add
      visibility attribute header in include/Makemodule.am, include/visibility-
      hidden.h.
    - d/p/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add xattrat
      syscall wrappers in configure.ac, include/Makemodule.am,
      include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.
    - d/p/CVE-2026-54371-03-add-xattrat-syscall-backwards-compatibility-
      code.patch: Add xattrat syscall backwards compatibility code in
      include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,
      libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-
      self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,
      libmisc/setxattrat_compat.c.
    - d/p/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch: Rename
      walk_tree to old_walk_tree in include/Makemodule.am,
      include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,
      tools/getfattr.c.
    - d/p/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the new
      walk_tree helper in include/Makemodule.am, include/walk_tree.h,
      libmisc/Makemodule.am, libmisc/walk_tree.c.
    - debian/patches/CVE-2026-54371-06-harden-getfattr.patch: harden getfattr in
      man/man1/getfattr.1, tools/getfattr.c, test/root/getfattr.test.
    - d/p/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-
      buffer.patch: setfattr: multiple --restore accesses freed buffer in
      tools/setfattr.c.
    - d/p/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-after-
      restore.patch: setfattr: Do not ignore --no-dereference after --restore in
      tools/setfattr.c.
    - d/p/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add openat2
      syscall wrapper in configure.ac, include/Makemodule.am, include/openat2.h,
      libmisc/Makemodule.am, libmisc/openat2.c.
    - debian/patches/CVE-2026-54371-10-harden-setfattr-restore.patch: harden
      setfattr --restore in configure.ac, man/man1/setfattr.1,
      test/Makemodule.am, tools/setfattr.c, test/restore.test.
    - CVE-2026-54371

 -- John Breton Sun, 23 Aug 2026 21:42:23 -0400

 (See more...)
CVE-2026-54371 attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate p

bzip2 Aug 31st 09:07
Release: resolute Repo: main Level: updates New version: 1.0.8-6ubuntu0.1
Packages in group:  bzip2-doc libbz2-1.0 libbz2-dev

bzip2 (1.0.8-6ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write
    - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not
      process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.
    - CVE-2026-42250

 -- Shishir Subedi Thu, 27 Aug 2026 09:49:34 +0545
CVE-2026-42250 bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds w

bzip2 Aug 31st 09:07
Release: noble Repo: main Level: updates New version: 1.0.8-5.1ubuntu0.1
Packages in group:  bzip2-doc libbz2-1.0 libbz2-dev

bzip2 (1.0.8-5.1ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write
    - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not
      process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.
    - CVE-2026-42250

 -- Shishir Subedi Thu, 27 Aug 2026 09:50:50 +0545
CVE-2026-42250 bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds w

bzip2 Aug 31st 09:07
Release: jammy Repo: main Level: updates New version: 1.0.8-5ubuntu0.1
Packages in group:  bzip2-doc libbz2-1.0 libbz2-dev

bzip2 (1.0.8-5ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write
    - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not
      process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.
    - CVE-2026-42250

 -- Shishir Subedi Thu, 27 Aug 2026 09:51:50 +0545
CVE-2026-42250 bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds w

bzip2 Aug 31st 07:07
Release: resolute Repo: main Level: security New version: 1.0.8-6ubuntu0.1
Packages in group:  bzip2-doc libbz2-1.0 libbz2-dev

bzip2 (1.0.8-6ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write
    - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not
      process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.
    - CVE-2026-42250

 -- Shishir Subedi Thu, 27 Aug 2026 09:49:34 +0545
CVE-2026-42250 bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds w

bzip2 Aug 31st 07:07
Release: noble Repo: main Level: security New version: 1.0.8-5.1ubuntu0.1
Packages in group:  bzip2-doc libbz2-1.0 libbz2-dev

bzip2 (1.0.8-5.1ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write
    - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not
      process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.
    - CVE-2026-42250

 -- Shishir Subedi Thu, 27 Aug 2026 09:50:50 +0545
CVE-2026-42250 bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds w

bzip2 Aug 31st 07:07
Release: jammy Repo: main Level: security New version: 1.0.8-5ubuntu0.1
Packages in group:  bzip2-doc libbz2-1.0 libbz2-dev

bzip2 (1.0.8-5ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write
    - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not
      process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.
    - CVE-2026-42250

 -- Shishir Subedi Thu, 27 Aug 2026 09:51:50 +0545
CVE-2026-42250 bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds w

openjdk-26 Aug 31st 02:07
Release: resolute Repo: universe Level: updates New version: 26.0.2+10-2~26.04.2
Packages in group:  openjdk-26-dbg openjdk-26-demo openjdk-26-doc openjdk-26-jdk openjdk-26-jdk-headless openjdk-26-jre openjdk-26-jre-headless openjdk-26-jre-zero openjdk-26-source openjdk-26-testsupport

openjdk-26 (26.0.2+10-2~26.04.2) resolute-security; urgency=medium

  * Upload to Ubuntu 26.04.

openjdk-26 Aug 31st 01:07
Release: resolute Repo: universe Level: security New version: 26.0.2+10-2~26.04.2
Packages in group:  openjdk-26-dbg openjdk-26-demo openjdk-26-doc openjdk-26-jdk openjdk-26-jdk-headless openjdk-26-jre openjdk-26-jre-headless openjdk-26-jre-zero openjdk-26-source openjdk-26-testsupport

openjdk-26 (26.0.2+10-2~26.04.2) resolute-security; urgency=medium

  * Upload to Ubuntu 26.04.


About   -   Send Feedback to @ubuntu_updates