{ "summary": { "snap": { "added": [], "removed": [], "diff": [ "snapd" ] }, "deb": { "added": [], "removed": [], "diff": [ "gawk", "libc-bin", "libc6", "libgssapi-krb5-2", "libk5crypto3", "libkrb5-3", "libkrb5support0", "libpam-modules", "libpam-modules-bin", "libpam-runtime", "libpam0g", "locales", "rsyslog", "tar" ] } }, "diff": { "deb": [ { "name": "gawk", "from_version": { "source_package_name": "gawk", "source_package_version": "1:5.1.0-1ubuntu0.1", "version": "1:5.1.0-1ubuntu0.1" }, "to_version": { "source_package_name": "gawk", "source_package_version": "1:5.1.0-1ubuntu0.2", "version": "1:5.1.0-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-40467", "url": "https://ubuntu.com/security/CVE-2026-40467", "cve_description": "Use After Free vulnerability has been found in \"io.c\" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40468", "url": "https://ubuntu.com/security/CVE-2026-40468", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40469", "url": "https://ubuntu.com/security/CVE-2026-40469", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-40467", "url": "https://ubuntu.com/security/CVE-2026-40467", "cve_description": "Use After Free vulnerability has been found in \"io.c\" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40468", "url": "https://ubuntu.com/security/CVE-2026-40468", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40469", "url": "https://ubuntu.com/security/CVE-2026-40469", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Use after free in io.c", " - debian/patches/CVE-2026-40467.patch: Memory management fix in io.c", " - CVE-2026-40467", " * SECURITY UPDATE: Integer overflow in builtin.c.", " - debian/patches/CVE-2026-40468.patch: Integer overflow fixes in builtin.c", " and node.c", " - debian/patches/CVE-2026-40469.patch: Add overflow checking in builtin.c", " - CVE-2026-40468", " - CVE-2026-40469", "" ], "package": "gawk", "version": "1:5.1.0-1ubuntu0.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 20 Jul 2026 16:38:47 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.13", "version": "2.35-0ubuntu3.13" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets", " - debian/patches/CVE-2026-4046.patch: Use pending character state in", " IBM1390, IBM1399 character sets in iconvdata/Makefile,", " iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.", " - CVE-2026-4046", " * SECURITY UPDATE: out-of-bounds write in deprecated debugging function", " - debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in", " ns_sprintrrf in resolv/ns_print.c.", " - CVE-2026-5435", " * SECURITY UPDATE: one byte heap buffer overflow in scanf %mc", " - debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in", " scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-", " bz34008.c, stdio-common/vfscanf-internal.c.", " - CVE-2026-5450", " * SECURITY UPDATE: crash or info disclosure in ungetwc function", " - debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte", " stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.", " - CVE-2026-5928", " * SECURITY UPDATE: crash in deprecated debugging functions", " - debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,", " __p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.", " - debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf", " formatting of class, type values in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of", " unknown records in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop", " failure in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in", " ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-", " ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.", " - CVE-2026-6238", "" ], "package": "glibc", "version": "2.35-0ubuntu3.14", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 08:11:17 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.13", "version": "2.35-0ubuntu3.13" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets", " - debian/patches/CVE-2026-4046.patch: Use pending character state in", " IBM1390, IBM1399 character sets in iconvdata/Makefile,", " iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.", " - CVE-2026-4046", " * SECURITY UPDATE: out-of-bounds write in deprecated debugging function", " - debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in", " ns_sprintrrf in resolv/ns_print.c.", " - CVE-2026-5435", " * SECURITY UPDATE: one byte heap buffer overflow in scanf %mc", " - debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in", " scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-", " bz34008.c, stdio-common/vfscanf-internal.c.", " - CVE-2026-5450", " * SECURITY UPDATE: crash or info disclosure in ungetwc function", " - debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte", " stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.", " - CVE-2026-5928", " * SECURITY UPDATE: crash in deprecated debugging functions", " - debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,", " __p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.", " - debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf", " formatting of class, type values in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of", " unknown records in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop", " failure in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in", " ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-", " ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.", " - CVE-2026-6238", "" ], "package": "glibc", "version": "2.35-0ubuntu3.14", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 08:11:17 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgssapi-krb5-2", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libk5crypto3", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libkrb5-3", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libkrb5support0", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules-bin", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-runtime", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam0g", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "locales", "from_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.13", "version": "2.35-0ubuntu3.13" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.35-0ubuntu3.14", "version": "2.35-0ubuntu3.14" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets", " - debian/patches/CVE-2026-4046.patch: Use pending character state in", " IBM1390, IBM1399 character sets in iconvdata/Makefile,", " iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.", " - CVE-2026-4046", " * SECURITY UPDATE: out-of-bounds write in deprecated debugging function", " - debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in", " ns_sprintrrf in resolv/ns_print.c.", " - CVE-2026-5435", " * SECURITY UPDATE: one byte heap buffer overflow in scanf %mc", " - debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in", " scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-", " bz34008.c, stdio-common/vfscanf-internal.c.", " - CVE-2026-5450", " * SECURITY UPDATE: crash or info disclosure in ungetwc function", " - debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte", " stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.", " - CVE-2026-5928", " * SECURITY UPDATE: crash in deprecated debugging functions", " - debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,", " __p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.", " - debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf", " formatting of class, type values in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of", " unknown records in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop", " failure in ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in", " ns_sprintrrf in resolv/ns_print.c.", " - debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-", " ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.", " - CVE-2026-6238", "" ], "package": "glibc", "version": "2.35-0ubuntu3.14", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 24 Jul 2026 08:11:17 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "rsyslog", "from_version": { "source_package_name": "rsyslog", "source_package_version": "8.2112.0-2ubuntu2.2", "version": "8.2112.0-2ubuntu2.2" }, "to_version": { "source_package_name": "rsyslog", "source_package_version": "8.2112.0-2ubuntu2.4", "version": "8.2112.0-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-61548", "url": "https://ubuntu.com/security/CVE-2026-61548", "cve_description": "mmpstrucdata stack buffer overflow with oversized RFC5424 structured data", "cve_priority": "medium", "cve_public_date": "2026-07-20" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-61548", "url": "https://ubuntu.com/security/CVE-2026-61548", "cve_description": "mmpstrucdata stack buffer overflow with oversized RFC5424 structured data", "cve_priority": "medium", "cve_public_date": "2026-07-20" } ], "log": [ "", " * SECURITY UPDATE: imptcp regex-framing remote denial of service", " - debian/patches/imptcp-security.patch: Fix logic in", " plugins/imptcp/imptcp.c.", " - CVE number pending", " * SECURITY UPDATE: mmpstrucdata stack buffer overflow with oversized", " RFC5424 structured data", " - debian/patches/CVE-2026-61548.patch: remove fixed-size buffer in", " plugins/mmpstrucdata/mmpstrucdata.c.", " - CVE-2026-61548", " * Temporarily work around gzip issue causing tests to fail on s390x", " - debian/rules: on s390x, run tests with DFLTCC=0", " - See LP: 2083700 for gzip issue", "" ], "package": "rsyslog", "version": "8.2112.0-2ubuntu2.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 20 Jul 2026 12:31:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "tar", "from_version": { "source_package_name": "tar", "source_package_version": "1.34+dfsg-1ubuntu0.1.22.04.5", "version": "1.34+dfsg-1ubuntu0.1.22.04.5" }, "to_version": { "source_package_name": "tar", "source_package_version": "1.34+dfsg-1ubuntu0.1.22.04.6", "version": "1.34+dfsg-1ubuntu0.1.22.04.6" }, "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2161311 ], "changes": [ { "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Old archives with nonzero directory sizes", " failing to be extracted", " - debian/patches/CVE-2026-5704-5.patch: fix this by forcing", " the size to zero for DIRTYPE in read_header() in src/list.c", " (LP: #2161311).", "" ], "package": "tar", "version": "1.34+dfsg-1ubuntu0.1.22.04.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2161311 ], "author": "Leonidas Da Silva Barbosa ", "date": "Mon, 20 Jul 2026 11:42:36 -0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [ { "name": "snapd", "from_version": { "source_package_name": null, "source_package_version": null, "version": "27407" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "27595" } } ] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20260722 to 20260727", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260722", "to_serial": "20260727", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }