Aggregator

USN-8015-1: Linux kernel vulnerabilities

1 week 1 day ago
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - SMB network file system; - io_uring subsystem; (CVE-2025-38561, CVE-2025-39698, CVE-2025-40019)

USN-8014-1: Linux kernel vulnerabilities

1 week 1 day ago
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - Unix domain sockets; (CVE-2025-40019, CVE-2025-40214)

USN-8013-1: Linux kernel vulnerabilities

1 week 1 day ago
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - SMB network file system; (CVE-2025-38561, CVE-2025-40019)

USN-8012-1: GitHub CLI vulnerabilities

1 week 1 day ago
It was discovered that GitHub CLI could behave unexpectedly if users downloaded a malicious GitHub Actions workflow artifact through gh run download. An attacker could possibly use this issue to create or overwrite files in unintended directories. (CVE-2024-54132) It was discovered that GitHub CLI could behave unexpectedly when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. An attacker could possibly use this issue to gather authentication tokens. (CVE-2024-53858)

USN-8011-1: Emacs vulnerabilities

1 week 1 day ago
It was discovered that Emacs could trigger unsafe Lisp macro expansion, when a user invoked elisp-completion-at-point on untrusted Emacs Lisp source code. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-53920) It was discovered that Emacs did not properly sanitize input when handling certain URI schemes. An attacker could possibly use this issue to execute arbitrary shell commands by tricking a user into opening a specially crafted URL. (CVE-2025-1244)

USN-8009-1: Django vulnerabilities

1 week 2 days ago
It was discovered that Django exposed timing information when checking passwords. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-13473) Jiyong Yang discovered that Django incorrectly handled malformed requests with duplicate headers. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2025-14550) Tarek Nakkouch discovered that Django incorrectly parsed raster lookups. An attacker could possibly use this issue to perform SQL injection attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-1207) Seokchan Yoon discovered that Django incorrectly handled malformed HTML inputs containing a large amount of unmatched HTML end tags. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-1285) Solomon Kebede discovered that Django incorrectly handled control characters in the dictionary expansion of certain QuerySet methods. An attacker could possibly use this issue to perform SQL injection attacks. (CVE-2026-1287) Solomon Kebede discovered that Django incorrectly handled column alias parsing with dictionary expansion. An attacker could possibly use this issue to perform SQL injection attacks. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-1312)

gnupg2-2.4.9-2.fc42

1 week 2 days ago
FEDORA-2026-59fdfa64f5 Packages in this update:
  • gnupg2-2.4.9-2.fc42
Update description:

Fix CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution

gnupg2-2.4.9-5.fc43

1 week 2 days ago
FEDORA-2026-d5c00a447f Packages in this update:
  • gnupg2-2.4.9-5.fc43
Update description:

Fix CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution

USN-8007-1: ImageMagick vulnerabilities

1 week 2 days ago
It was discovered that ImageMagick incorrectly handled image depth values when processing MIFF image files. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2025-43965) It was discovered that ImageMagick incorrectly processed SVG images and MSL files. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-68618) It was discovered that ImageMagick incorrectly handled memory when converting MVG files. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-69204)

USN-8006-1: MySQL vulnerabilities

1 week 2 days ago
Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to 8.0.45 in Ubuntu 20.04 LTS. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-45.html https://www.oracle.com/security-alerts/cpujan2026.html

USN-8005-1: GNU C Library vulnerabilities

1 week 2 days ago
Vitaly Simonovich discovered that the GNU C Library did not properly initialize the input when WRDE_REUSE is used. An attacker could possibly use this issue to cause applications to crash, leading to a denial of service. (CVE-2025-15281) Anastasia Belova discovered that the GNU C Library incorrectly handled the regcomp function when memory allocation failures occured. An attacker could possibly use this issue to cause applications to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-8058) Igor Morgenstern discovered that the GNU C Library incorrectly handled the memalign function when doing memory allocation. An attacker could possibly use this issue to cause applications to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0861) Igor Morgenstern discovered that the GNU C Library incorrectly handled certain DNS backend when queries for a zero-valued network. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-0915)