{ "summary": { "snap": { "added": [], "removed": [], "diff": [ "snapd" ] }, "deb": { "added": [], "removed": [], "diff": [ "gawk", "libgssapi-krb5-2:armhf", "libk5crypto3:armhf", "libkrb5-3:armhf", "libkrb5support0:armhf", "libpam-modules:armhf", "libpam-modules-bin", "libpam-runtime", "libpam0g:armhf", "rsyslog", "tar" ] } }, "diff": { "deb": [ { "name": "gawk", "from_version": { "source_package_name": "gawk", "source_package_version": "1:5.1.0-1ubuntu0.1", "version": "1:5.1.0-1ubuntu0.1" }, "to_version": { "source_package_name": "gawk", "source_package_version": "1:5.1.0-1ubuntu0.2", "version": "1:5.1.0-1ubuntu0.2" }, "cves": [ { "cve": "CVE-2026-40467", "url": "https://ubuntu.com/security/CVE-2026-40467", "cve_description": "Use After Free vulnerability has been found in \"io.c\" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40468", "url": "https://ubuntu.com/security/CVE-2026-40468", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40469", "url": "https://ubuntu.com/security/CVE-2026-40469", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-40467", "url": "https://ubuntu.com/security/CVE-2026-40467", "cve_description": "Use After Free vulnerability has been found in \"io.c\" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40468", "url": "https://ubuntu.com/security/CVE-2026-40468", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" }, { "cve": "CVE-2026-40469", "url": "https://ubuntu.com/security/CVE-2026-40469", "cve_description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.", "cve_priority": "medium", "cve_public_date": "2026-07-13 13:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Use after free in io.c", " - debian/patches/CVE-2026-40467.patch: Memory management fix in io.c", " - CVE-2026-40467", " * SECURITY UPDATE: Integer overflow in builtin.c.", " - debian/patches/CVE-2026-40468.patch: Integer overflow fixes in builtin.c", " and node.c", " - debian/patches/CVE-2026-40469.patch: Add overflow checking in builtin.c", " - CVE-2026-40468", " - CVE-2026-40469", "" ], "package": "gawk", "version": "1:5.1.0-1ubuntu0.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 20 Jul 2026 16:38:47 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgssapi-krb5-2:armhf", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libk5crypto3:armhf", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libkrb5-3:armhf", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libkrb5support0:armhf", "from_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.7", "version": "1.19.2-2ubuntu0.7" }, "to_version": { "source_package_name": "krb5", "source_package_version": "1.19.2-2ubuntu0.8", "version": "1.19.2-2ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-11850", "url": "https://ubuntu.com/security/CVE-2026-11850", "cve_description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "cve_priority": "medium", "cve_public_date": "2026-06-11 10:16:00 UTC" }, { "cve": "CVE-2026-4035", "url": "https://ubuntu.com/security/CVE-2026-4035", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-40355", "url": "https://ubuntu.com/security/CVE-2026-40355", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 06:16:00 UTC" }, { "cve": "CVE-2026-40356", "url": "https://ubuntu.com/security/CVE-2026-40356", "cve_description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "cve_priority": "medium", "cve_public_date": "2026-04-28 07:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: nteger underflow berval2tl_data()", " - debian/patches/CVE-2026-11850.patch: Prevent read overrun in libkdb_ldap", " in src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.", " - CVE-2026-11850", " * SECURITY UPDATE: security issues in the NegoEx mechanism", " - debian/patches/CVE-2026-4035x.patch: Fix two NegoEx parsing", " vulnerabilities in src/lib/gssapi/spnego/negoex_util.c.", " - CVE-2026-40355", " - CVE-2026-40356", "" ], "package": "krb5", "version": "1.19.2-2ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 15 Jul 2026 14:26:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules:armhf", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules-bin", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-runtime", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam0g:armhf", "from_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.6", "version": "1.4.0-11ubuntu2.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.4.0-11ubuntu2.7", "version": "1.4.0-11ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.4.0-11ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 10:06:00 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "rsyslog", "from_version": { "source_package_name": "rsyslog", "source_package_version": "8.2112.0-2ubuntu2.2", "version": "8.2112.0-2ubuntu2.2" }, "to_version": { "source_package_name": "rsyslog", "source_package_version": "8.2112.0-2ubuntu2.4", "version": "8.2112.0-2ubuntu2.4" }, "cves": [ { "cve": "CVE-2026-61548", "url": "https://ubuntu.com/security/CVE-2026-61548", "cve_description": "mmpstrucdata stack buffer overflow with oversized RFC5424 structured data", "cve_priority": "medium", "cve_public_date": "2026-07-20" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-61548", "url": "https://ubuntu.com/security/CVE-2026-61548", "cve_description": "mmpstrucdata stack buffer overflow with oversized RFC5424 structured data", "cve_priority": "medium", "cve_public_date": "2026-07-20" } ], "log": [ "", " * SECURITY UPDATE: imptcp regex-framing remote denial of service", " - debian/patches/imptcp-security.patch: Fix logic in", " plugins/imptcp/imptcp.c.", " - CVE number pending", " * SECURITY UPDATE: mmpstrucdata stack buffer overflow with oversized", " RFC5424 structured data", " - debian/patches/CVE-2026-61548.patch: remove fixed-size buffer in", " plugins/mmpstrucdata/mmpstrucdata.c.", " - CVE-2026-61548", " * Temporarily work around gzip issue causing tests to fail on s390x", " - debian/rules: on s390x, run tests with DFLTCC=0", " - See LP: 2083700 for gzip issue", "" ], "package": "rsyslog", "version": "8.2112.0-2ubuntu2.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 20 Jul 2026 12:31:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "tar", "from_version": { "source_package_name": "tar", "source_package_version": "1.34+dfsg-1ubuntu0.1.22.04.5", "version": "1.34+dfsg-1ubuntu0.1.22.04.5" }, "to_version": { "source_package_name": "tar", "source_package_version": "1.34+dfsg-1ubuntu0.1.22.04.6", "version": "1.34+dfsg-1ubuntu0.1.22.04.6" }, "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2161311 ], "changes": [ { "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "log": [ "", " * SECURITY REGRESSION: Old archives with nonzero directory sizes", " failing to be extracted", " - debian/patches/CVE-2026-5704-5.patch: fix this by forcing", " the size to zero for DIRTYPE in read_header() in src/list.c", " (LP: #2161311).", "" ], "package": "tar", "version": "1.34+dfsg-1ubuntu0.1.22.04.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2161311 ], "author": "Leonidas Da Silva Barbosa ", "date": "Mon, 20 Jul 2026 11:42:36 -0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [ { "name": "snapd", "from_version": { "source_package_name": null, "source_package_version": null, "version": "27408" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": "27594" } } ] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20260722 to 20260725", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260722", "to_serial": "20260725", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }