Ubuntu Security Advisories

It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.

USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. In addition, this update fixes CVE-2026-42533 for these releases. It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could possibly use this issue to crash nginx, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533) Original advisory details: It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479) It was discovered that nginx incorrectly handled HTTP/3 requests when proxy_request_buffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101) It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205) It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)

USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop processing RPKI updates after the first one, so routes were not revalidated when RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to start when the RPKI module was enabled. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Iggy Frankovic discovered that FRR incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2024-44070) It was discovered that FRR re-validated all routes in certain instances when the internal socket's buffer size overflowed. A remote attacker could possibly use this issue to impact the performance of FRR, resulting in a denial of service. (CVE-2024-55553)

USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the update caused a regression when processing certain chunked requests. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353) It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110354)

It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources, leading to a denial of service.

It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-54058) It was discovered that Pillow did not properly check for decompression bombs when processing font files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379) It was discovered that Pillow did not properly check for decompression bombs when loading GD image files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-55380) It was discovered that Pillow incorrectly validated filter sizes in the rank filter implementation. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59197) It was discovered that Pillow incorrectly handled image coordinate calculations. An attacker could possibly use this issue to cause Pillow to crash. (CVE-2026-59199) It was discovered that Pillow did not properly limit the size of decompressed PDF stream data. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59200) It was discovered that Pillow incorrectly parsed EPS files containing a negative byte count in the BeginBinary directive. An attacker could possibly use this issue to cause Pillow to hang, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59203) It was discovered that Pillow incorrectly accumulated JPEG2000 tile component widths. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59204) It was discovered that Pillow incorrectly validated image mode compatibility in color management transforms. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59205)

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches.

It was discovered that Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker could possibly use this issue to cause Net-SNMP to block indefinitely, resulting in a denial of service.

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Original advisory details: It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.

Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.

It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-59933) It was discovered that libvips incorrectly determined image dimensions in the vipsload operation, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-33327) It was discovered that libvips incorrectly determined image dimensions in the gifload operation on 32-bit systems, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-33328) It was discovered that libvips did not properly validate EXIF tag groups. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-35590) It was discovered that libvips incorrectly determined the number of channels in certain encoded tiles within TIFF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591) It was discovered that libvips incorrectly validated scanlines in certain TIFF images with many bands, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, obtain sensitive information, or possibly execute arbitrary code. (CVE-2026-69242) It was discovered that libvips incorrectly calculated frame heights when loading certain multi-page TIFF images through ImageMagick. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-70651) It was discovered that libvips incorrectly handled certain Radiance images. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-70653) It was discovered that libvips incorrectly calculated read sizes when processing certain uncompressed PPM images from custom sources. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70654)

It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.

It was discovered that the shpsort utility in Shapelib incorrectly handled certain inputs, leading to a double free. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.

It was discovered that rxvt-unicode incorrectly handled certain escape sequences. An attacker could possibly use this issue to execute arbitrary code if a user displayed specially crafted text in the terminal.

It was discovered that Sprockets incorrectly handled certain specially crafted requests when the Sprockets server was used in production. A remote attacker could possibly use this issue to access files outside of the application's root directory.

It was discovered that Relax-and-Recover created a world-readable initrd when GRUB_RESCUE was enabled. A local attacker could possibly use this issue to obtain sensitive information.

It was discovered that libuser did not properly validate the GECOS field when changing user information. A local attacker could possibly use this issue to corrupt the passwd file, resulting in a denial of service. (CVE-2015-3245) It was discovered that libuser modified the passwd file in place when updating user information. A local attacker could possibly use this issue to cause an inconsistent file state, resulting in a denial of service, or possibly escalate privileges. (CVE-2015-3246)

Dawid Golunski discovered that Swift Mailer did not properly sanitize e-mail addresses in the mail transport. A remote attacker could possibly use this issue to pass extra parameters to the mail command and execute arbitrary code.

It was discovered that Net::EasyTCP used the built-in Perl rand() function to generate encryption keys when no strong randomization module was present. An attacker could possibly use this issue to predict the keys and obtain sensitive information.

It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. A remote attacker could possibly use this issue to bypass authentication.