4 days 4 hours ago
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates
in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04
LTS.
Original advisory details:
It was discovered that PHP incorrectly handled out-of-memory conditions
while processing requests. A remote attacker could use this issue to
execute arbitrary code. (CVE-2026-109618)
It was discovered that PHP incorrectly managed internal request state
across worker reuse. A remote attacker could use this issue to execute
arbitrary code. (CVE-2026-109619)
4 days 10 hours ago
It was discovered that Unbound incorrectly handled certain TCP connections.
A remote attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. This issue only affected Ubuntu
26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.
(CVE-2026-80225)
It was discovered that Unbound incorrectly handled certain DNS responses. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-81634)
It was discovered that Unbound incorrectly handled certain DNS responses
during DNSSEC validation. A remote attacker could possibly use this issue
to cause Unbound to consume resources, leading to a denial of service.
(CVE-2026-85501)
It was discovered that Unbound incorrectly handled outgoing network ports.
A remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-50252)
It was discovered that Unbound incorrectly handled certain DNSCrypt
packets. A remote attacker could possibly use this issue to crash Unbound,
resulting in a denial of service. This issue only affected Ubuntu 26.04
LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04
LTS. (CVE-2026-40691)
It was discovered that Unbound incorrectly handled certain cached DNS
responses. A remote attacker could possibly use this issue to poison
Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04
LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)
It was discovered that Unbound incorrectly handled certain DNS-over-QUIC
connections. A remote attacker could possibly use this issue to cause
Unbound to consume resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-32665)
It was discovered that Unbound incorrectly handled certain EDNS options. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-55973)
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Unbound incorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. This issue only affected Ubuntu
18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)
It was discovered that Unbound incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Unbound to consume resources, leading to a denial of service. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04
LTS. (CVE-2023-50868)
