USN-9046-1: MySQL vulnerabilities

Ubuntu Security Advisories

1 day 6 hours ago

Multiple security issues were discovered in MySQL. MySQL has been updated to 8.4.13 in Ubuntu 26.04 LTS. Ubuntu 26.10 has been updated to MySQL 9.7.4. Ubuntu 22.04 LTS and Ubuntu 24.04 LTS packages have been updated with backported patches. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-4.html https://www.oracle.com/security-alerts/cpuoct2026.html

USN-9041-1: uutils coreutils vulnerabilities

Ubuntu Security Advisories

1 day 13 hours ago

It was discovered that uutils coreutils mkfifo incorrectly continued processing when a target file already existed, applying default permissions to the existing file. A local attacker could possibly use this issue to obtain sensitive information or modify file permissions unexpectedly. (CVE-2026-35341) It was discovered that uutils coreutils dd incorrectly suppressed errors during file truncation operations. A local attacker could possibly use this issue to cause silent data corruption. (CVE-2026-35344) It was discovered that uutils coreutils tail incorrectly followed symbolic links when using the --follow=name option. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35345) It was discovered that uutils coreutils sort crashed when processing filenames containing non-UTF-8 bytes. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35348) It was discovered that uutils coreutils cp incorrectly preserved setuid and setgid bits when ownership changes failed. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-35350) It was discovered that uutils coreutils mv failed to preserve file ownership when moving files across file system boundaries. A local attacker could possibly use this issue to obtain sensitive information or cause unintended access restrictions. (CVE-2026-35351) It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition in its extended attribute preservation logic. A local attacker with write access to a directory could possibly use this issue to modify security labels on unintended files. (CVE-2026-35354) It was discovered that uutils coreutils cp had a race condition in its file creation logic, initially creating destination files with overly permissive modes. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35357) It was discovered that uutils coreutils cp had a time-of-check to time-of-use race condition when handling symbolic links. A local attacker with write access to a directory could possibly use this issue to obtain sensitive information. (CVE-2026-35359) It was discovered that uutils coreutils touch had a time-of-check to time-of-use race condition during file creation. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35360) It was discovered that uutils coreutils rm failed to recognize trailing slashes on the current directory path. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35363) It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition during cross-device operations. A local attacker with write access to a directory could possibly use this issue to overwrite arbitrary files. (CVE-2026-35364) It was discovered that uutils coreutils nohup created its output file with world-readable permissions. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35367) It was discovered that uutils coreutils chroot incorrectly resolved user specifications before dropping root privileges, allowing Name Service Switch modules to be loaded from the new root directory. A local attacker with write access to the chroot directory could possibly use this issue to execute arbitrary code as root. (CVE-2026-35368) It was discovered that uutils coreutils ln failed to process filenames containing non-UTF-8 bytes, causing the utility to exit with an error. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35373) It was discovered that uutils coreutils split had a time-of-check to time-of-use race condition in its input and output file validation. A local attacker with write access to a directory could possibly use this issue to cause data loss. (CVE-2026-35374) It was discovered that uutils coreutils chcon had a time-of-check to time-of-use race condition during recursive relabeling operations. A local attacker with write access to a directory could possibly use this issue to modify security labels on unintended files. (CVE-2026-35376) It was discovered that uutils coreutils env incorrectly handled backslash sequences within single quotes when using the -S option. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35377) It was discovered that uutils coreutils install applied setuid and setgid mode bits to destination files before completing ownership changes. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-93658)

Checked

28 minutes 27 seconds ago

URL

https://ubuntu.com/security/notices/rss.xml