1 hour 6 minutes ago
USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the
corresponding fix for U-Boot on Ubuntu 26.10.
Original advisory details:
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot
incorrectly handled certain NFS READ and NFS READLINK responses. An
attacker could possibly use this issue to trigger a buffer overflow,
resulting in a denial of service or arbitrary code execution.
(CVE-2026-74220, CVE-2026-74221)
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot
incorrectly handled certain HTTP data storage failures in its lwIP
implementation. An attacker could possibly use this issue to trigger a
use-after-free, resulting in a denial of service. (CVE-2026-74222)
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not
properly validate certain DHCPv6 option lengths during network boot. An
attacker could possibly use this issue to trigger out-of-bounds memory
access, resulting in a denial of service. (CVE-2026-74225)
1 hour 29 minutes ago
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates
in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04
LTS.
Original advisory details:
It was discovered that PHP incorrectly handled out-of-memory conditions
while processing requests. A remote attacker could use this issue to
execute arbitrary code. (CVE-2026-109618)
It was discovered that PHP incorrectly managed internal request state
across worker reuse. A remote attacker could use this issue to execute
arbitrary code. (CVE-2026-109619)
7 hours 14 minutes ago
It was discovered that Unbound incorrectly handled certain TCP connections.
A remote attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. This issue only affected Ubuntu
26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.
(CVE-2026-80225)
It was discovered that Unbound incorrectly handled certain DNS responses. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-81634)
It was discovered that Unbound incorrectly handled certain DNS responses
during DNSSEC validation. A remote attacker could possibly use this issue
to cause Unbound to consume resources, leading to a denial of service.
(CVE-2026-85501)
It was discovered that Unbound incorrectly handled outgoing network ports.
A remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-50252)
It was discovered that Unbound incorrectly handled certain DNSCrypt
packets. A remote attacker could possibly use this issue to crash Unbound,
resulting in a denial of service. This issue only affected Ubuntu 26.04
LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04
LTS. (CVE-2026-40691)
It was discovered that Unbound incorrectly handled certain cached DNS
responses. A remote attacker could possibly use this issue to poison
Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04
LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)
It was discovered that Unbound incorrectly handled certain DNS-over-QUIC
connections. A remote attacker could possibly use this issue to cause
Unbound to consume resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-32665)
It was discovered that Unbound incorrectly handled certain EDNS options. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-55973)
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Unbound incorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. This issue only affected Ubuntu
18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)
It was discovered that Unbound incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Unbound to consume resources, leading to a denial of service. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04
LTS. (CVE-2023-50868)
