========================================================================== Ubuntu Security Notice USN-8218-1 April 30, 2026 zulucrypt vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: zuluCrypt could be made to run programs as an administrator. Software Description: - zulucrypt: A simple, feature rich and powerful solution for hard drives encryption Details: Aaron Rainbolt discovered that zuluCrypt used insecure PolicyKit settings in zuluPolkit. An attacker could possibly use this issue to cause local privilege escalation to root. (CVE-2025-53391) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS libzulucrypt-dev 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro libzulucrypt-exe-dev 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro libzulucrypt-exe1.2.0 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro libzulucrypt-plugins 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro libzulucrypt1.2.0 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro libzulucryptpluginmanager-dev 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro libzulucryptpluginmanager1.0.0 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro zulucrypt-cli 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro zulucrypt-gui 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro zulumount-cli 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro zulumount-gui 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro zulupolkit 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro zulusafe-cli 6.2.0-1ubuntu3+esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS libzulucrypt-dev 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt-exe-dev 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt-exe1.2.0 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt-plugins 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt1.2.0 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro libzulucryptpluginmanager-dev 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro libzulucryptpluginmanager1.0.0 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro zulucrypt-cli 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro zulucrypt-gui 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro zulumount-cli 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro zulumount-gui 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro zulupolkit 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro zulusafe-cli 5.7.1-2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS libzulucrypt-dev 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt-exe-dev 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt-exe1.2.0 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt-plugins 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro libzulucrypt1.2.0 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro libzulucryptpluginmanager-dev 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro libzulucryptpluginmanager1.0.0 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro zulucrypt-cli 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro zulucrypt-gui 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro zulumount-cli 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro zulumount-gui 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro zulupolkit 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro zulusafe-cli 5.7.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libzulucrypt-dev 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro libzulucrypt-exe-dev 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro libzulucrypt-exe1.2.0 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro libzulucrypt-plugins 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro libzulucrypt1.2.0 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro libzulucryptpluginmanager-dev 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro libzulucryptpluginmanager1.0.0 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro zulucrypt-cli 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro zulucrypt-gui 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro zulumount-cli 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro zulumount-gui 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro zulupolkit 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro zulusafe-cli 5.4.0-2ubuntu0.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8218-1 CVE-2025-53391
Thursday, April 30, 2026
FreeBSD Errata Notice FreeBSD-EN-26:08.pf
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-26:08.pf Errata Notice The FreeBSD Project Topic: Incorrect duplicate rule detection for automatic tables Category: core Module: pf Announced: 2026-04-29 Credits: Michael Sinatra Affects: FreeBSD 15.0 Corrected: 2026-04-26 10:12:28 UTC (stable/15, 15.0-STABLE) 2026-04-29 14:48:24 UTC (releng/15.0, 15.0-RELEASE-p7) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background pf is an Internet Protocol packet filter originally written for OpenBSD. While loading its configuration, pf hashes rules and silently drops duplicates as an optimisation. Only the first rule with the same hash is considered. II. Problem Description While checking for duplicate rules pf did not distinguish automatically created tables from each other. As a result some of those rules may have unexpectedly not been loaded. III. Impact The ruleset loaded in the kernel might not match the configured ruleset. IV. Workaround This problem only affects rules with tables created by the pfctl rules optimiser. Either disable ruleset optimisation ('set ruleset-optimization none'), or avoid constructs which would be optimisised into a table (e.g. by manually creating such tables). V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your system installed from base system packages: Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r now 2) To update your system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, which were not installed using base system packages, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r now 3) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/EN-26:08/pf.patch # fetch https://security.FreeBSD.org/patches/EN-26:08/pf.patch.asc # gpg --verify pf.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ fdcc60f52841 stable/15-n283345 releng/15.0/ d91d13c12484 releng/15.0-n281025 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:08.pf.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnySREbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvIygQAKSJuU4Ka3cRRqje85kA O03aC+IoU1YOaepkziI4TKxwKNSc7wh4S0xlCBiNXDqM9JUs20XbG47JT1GDUKP9 TNDymnUxNGjzmgEwbh/ZQvTKGqib2d0c4fhvLWMSg6FAbET8EnkyniM5A55QfUX0 YwsTFRk27K09AcCW8gpoRgAjJBhdlN18SvvlE8CQ57xpUQnukFJp+zh37OCGkRVO fciwOmEYmsrIur9vde7RX/ohBX2RbB3QrMQh9x4td+RpwUGfEkZ4oei+aJWJazVW VimwkJXXSl2Hdn4V/eNPKj3viSu40tgTPQelSgh1qFPxLMTVvRf1I8VlKYTFHV1O 0EGGsya4nE1pEYWL1CWh/9v2BoTiV7OVDEcu1prc9p/5dHv4cDNaaRf5ZMN8f7Sp S1X1eHY/eJ59ayBCPNShOMTf36hvMuQT9hBXdBArb6MpeGLubWFtGsHkaFZtoBvj QnpH4uTxeDMTZANqoM3t6QqrwDUEKBn9ai25k/k9a7vqYwrcLUo4WsLauiwhAbz0 7bmnXUE+gbn5qlX03UFLqANA7OujEjuBxc5+vmlJXK+1CARMcQToDEdMojhkBwbN xgxGtyol/Pq3MwvGZyKMlQii0xre2sA1Gqv41k4l7oPukU8DRAOFZQ9nDBmIB0NW s9JLPOImH1NE9iA05ezJk46Q =7VtI -----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-26:12.dhclient
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:12.dhclient Security Advisory The FreeBSD Project Topic: Remote code execution via malicious DHCP options Category: core Module: dhclient Announced: 2026-04-29 Credits: Joshua Rogers of AISLE Research Team Affects: All supported versions of FreeBSD. Corrected: 2026-04-29 14:47:47 UTC (stable/15, 15.0-STABLE) 2026-04-29 14:48:28 UTC (releng/15.0, 15.0-RELEASE-p7) 2026-04-29 14:48:50 UTC (stable/14, 14.4-STABLE) 2026-04-29 14:49:41 UTC (releng/14.4, 14.4-RELEASE-p3) 2026-04-29 14:49:22 UTC (releng/14.3, 14.3-RELEASE-p12) 2026-04-29 14:50:06 UTC (stable/13, 13.5-STABLE) 2026-04-29 14:50:18 UTC (releng/13.5, 13.5-RELEASE-p13) CVE Name: CVE-2026-42511 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background dhclient(8) is the default IPv4 DHCP client used on FreeBSD. It is responsible for contacting DHCP servers on a network segment and for initialising and configuring network interfaces based on received information. II. Problem Description The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it. III. Impact A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient. IV. Workaround No workaround is available. Systems not running dhclient(8) are not affected. The attacker needs to be on the same broadcast domain and respond to DHCP requests. A well-managed network will configure DHCP snooping on switches to prevent rogue DHCP servers from operating. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, which were not installed using base system packages, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:12/dhclient.patch # fetch https://security.FreeBSD.org/patches/SA-26:12/dhclient.patch.asc # gpg --verify dhclient.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. Restart the applicable daemons, or reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 2621f6c5d4ae stable/15-n283377 releng/15.0/ e7b4fb41aafa releng/15.0-n281029 stable/14/ b3087e05e848 stable/14-n274076 releng/14.4/ 73b801e3b5b3 releng/14.4-n273691 releng/14.3/ dda71167a101 releng/14.3-n271492 stable/13/ 46c01e4dd102 stable/13-n259859 releng/13.5/ a2d45189b9ee releng/13.5-n259215 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-42511> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:12.dhclient.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnySScbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv/HEQANr71RMaW0408Cp2xZ/n DN8DsU7vCXPDcZWF/HAl+COurXipEycxnP6pBdm2uCqRGWXmNPkjyA5nyoAM2qYP 9b3rXQHKdrqc0vvbjJuahzqfttwcv1jFQp+8Z8N8TYWUnETprai5VOwZ+7p2caGC gZg3UkS8qx7+qUZn1c1nOpYgW7AE1cxuBzSM3O/4pyaSnnMGgeUcz/utv+F272rn /rdDaC1nvH09OKIJOqBxOQ7m7izTBu70P1zhuWmGDAzmvy1sNCUpv325iFBc7B78 fRvINps878aSqheJqIx2jpeykW+nBjbVpsh++0ZUNjoWQTbZM7WaxNJxD4KjdInW zvK24qX34aMrY4pS0BjpQ46RTkEIDFnzSYTUAN+33LQ9rQ+1DaUF0UJAlO10XBQ+ 6J1ZDXnSmqOsXu2pnRyXWKrsliz6+j3LOzkJoc2gQFwiDzex20ZJtO3Jd2dVMJ5a F/jN5SY800LhvCbPFPL4k03xK98n7fLs432jsJOMYtRvY9N62oEbufBj0dCS0S15 A7Vj537ziRZuGt4xz3vdE48GEBdxm+frPNadS8IurW1gDN4Rr0d5VLfKFwMsiSXr baVMWTjn6kcfpomYDhl5451lDAyhZ20qFxx9M1lRNj7ploz4khmdv1e1zqENocQd t4eQrptk4YUgxEIZ0R56b2qf =h/Vp -----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-26:16.libnv
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:16.libnv Security Advisory The FreeBSD Project Topic: Stack overflow via select() file descriptor set overflow Category: core Module: libnv Announced: 2026-04-29 Credits: Joshua Rogers of AISLE Research Team Affects: All supported versions of FreeBSD. Corrected: 2026-04-29 14:47:51 UTC (stable/15, 15.0-STABLE) 2026-04-29 14:48:32 UTC (releng/15.0, 15.0-RELEASE-p7) 2026-04-29 14:48:56 UTC (stable/14, 14.4-STABLE) 2026-04-29 14:49:47 UTC (releng/14.4, 14.4-RELEASE-p3) 2026-04-29 14:49:27 UTC (releng/14.3, 14.3-RELEASE-p12) 2026-04-29 14:50:09 UTC (stable/13, 13.5-STABLE) 2026-04-29 14:50:21 UTC (releng/13.5, 13.5-RELEASE-p13) CVE Name: CVE-2026-39457 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background libnv is a general-purpose library designed for storing and exchanging sets of name-value pairs. This library can serve as an Inter-Process Communication (IPC) framework, enabling processes to exchange data and file descriptors. For example, it is used in libcasper to establish communication between privileged and unprivileged processes. Additionally, libnv can function as an interface for communication between userland and kernel. Originally, libnv was inspired by OpenZFS' nvlist implementation. However, the implementations are separate. This advisory relates only to the base system implementation of libnv, not to the one in OpenZFS. II. Problem Description When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024). III. Impact An attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption. If the target application is setuid-root, then this could be used to elevate local privileges. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date and reboot. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:16/libnv.patch # fetch https://security.FreeBSD.org/patches/SA-26:16/libnv.patch.asc # gpg --verify libnv.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. d) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 025789eaa648 stable/15-n283380 releng/15.0/ 7e4d5363ddce releng/15.0-n281032 stable/14/ 45809b0e1bc1 stable/14-n274081 releng/14.4/ a5cb4863d65a releng/14.4-n273696 releng/14.3/ a872c32f389e releng/14.3-n271496 stable/13/ 4acc2b5c61a7 stable/13-n259862 releng/13.5/ 32d12677ff45 releng/13.5-n259218 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-39457> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:16.libnv.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnySTUbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvEdwQAKF0kwMDT0ZjvcDnvqXa NmJEse7XRdFDWDcMp8NtSQK5DTYBRpUgwWiC7M+HRr4QIf/aIjzwuJdu1luK913i vAJJUbAaEAdGbNqd35FtDlnTWQE638R4HQ0TqMBrUfGTSp0O5SPOpTSPXB1Fw/F7 Q3c22lNDHgxgZ8+DOoJH70HgjdVskz3ezZroYUKfmk5vh9yZtVM9zMr6iGr6TUA7 OEbIrMlRCJ3pI9dOSGNKz1i/3s8bMS3U3nvAWIYPdSjKQBOyRdHoZHtk4SfY9TVs epqQQccUv9g5+E1QgxxoQHLR4dLkCHEJKOU2sqc/qW9KISX2rsTd2UYgYubxtb+j CIzTg23/rkMMhCi3VZ9NVLmGrxZclxyvAVJ/V3942jjag0c1onc+5RH0IGAljgay hobn3CBqE2NIOjoFyCJK9RcZ+wtvxFoQFdX6A56h5vDD2I/H7MIFJ0EnW3aWvT8f 0xiWhD4//9AU3+06soPt6l4tE/YaXJbcvYb92kC1JbbGVApMrDYbdxu3QK8HwAlV mNTFd3hgoEzlCiFH9vDNK/RIsVE67kb4KjqZKC1ElWrQbawQZtnKUigpxGcZbhCC 9zwXgoFRHCzeBiO77anQMgArNuY3Wj29beepzCvOA7u/KRyDTvDat8YRWNKbWS5L T3cMyFqgRkUgr7tajk0L51Xx =Edvm -----END PGP SIGNATURE-----
FreeBSD Errata Notice FreeBSD-EN-26:10.amd64
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-26:10.amd64 Errata Notice The FreeBSD Project Topic: TLB invalidation bug on AMD systems with INVLPGB Category: core Module: vm Announced: 2026-04-29 Affects: FreeBSD 14.3 and later Corrected: 2026-04-23 13:48:45 UTC (stable/15, 15.0-STABLE) 2026-04-29 14:48:26 UTC (releng/15.0, 15.0-RELEASE-p7) 2026-04-23 13:49:23 UTC (stable/14, 14.4-STABLE) 2026-04-29 14:49:39 UTC (releng/14.4, 14.4-RELEASE-p3) 2026-04-29 14:49:19 UTC (releng/14.3, 14.3-RELEASE-p12) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background On multi-core systems, TLB invalidation operations must notify other cores, as each core maintains a local TLB. On amd64 systems this has historically been implemented using interprocessor interrupts. Recent AMD CPUs provide a new instruction, invlpgb, which allows a core to broadcast TLB invalidations to other cores without need to explicitly raise interrupts. The FreeBSD kernel makes use of this instruction when available. II. Problem Description The FreeBSD implementation of ranged TLB invalidation took advantage of a bit in an invlpgb operand to invalidate consecutive 2M entries, instead of invalidating purely in increments of 4K pages. The hardware invlpgb implementation uses the underlying page size to invalidate regardless of the status of this bit, which may leave a series of 4K mappings intact that should have been invalidated. III. Impact Failing to invalidate pages when it required may result in apparent kernel memory corruption, typically resulting in a kernel panic. Workloads involving heavy use of kqueue(2) and/or large file descriptor tables seem to trigger the problem somewhat readily. IV. Workaround Intel and non-x86 systems are not affected. AMD systems that support INVLPGB (reported during the kernel boot process in "AMD Extended Feature Extensions ID EBX") may set vm.pmap.invlpgb_works=0 in /boot/loader.conf to work around this issue by disabling the use of invlpgb. V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your system installed from base system packages: Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, which were not installed using base system packages, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/EN-26:10/amd64.patch # fetch https://security.FreeBSD.org/patches/EN-26:10/amd64.patch.asc # gpg --verify amd64.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 280cfe2264d7 stable/15-n283199 releng/15.0/ 182c59658218 releng/15.0-n281027 stable/14/ ff11ae166cd9 stable/14-n274021 releng/14.4/ b00785205990 releng/14.4-n273689 releng/14.3/ 3b1365cb816e releng/14.3-n271489 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293382> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:10.amd64.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnySRcbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv4zAP/3/9no397tY5+uMITwzb d8RklxyJatGAYnqSQrJCjxm4er+CUijdCb6jUrg2L2hKt8c3KOQctSY5ko2agkZ2 41ghOeIOU6N9+aiNN4wlqCbgufUXjtBWBBEgOvJHyU1QnSazKDZmGAwWfiTz8Uh7 QtuRHV/I8LDKpd6UtVC6S6lsKSiDrmMQ6CmDSMiMDEpJO8cM1rKejU/gGSTaiwak 25SvR6z1rgJwh5VFKnT5a7G9Gw3oV04+zWQRoYOotiblg1qUgLAjMxogrIvFQKbR fQElldSwQl7ErlFjYCBrvDbXzGqlsDDab05ay4361VD92QWQ4o64X5KHR+Rb0yYt RWfPxfCNA1fNMDjkY1y9ROjGERuNdhJzGl5o2m6TXJl/rUX+BZrWZLTC/68CMy/B DHrKPMLRD6rOS6AupNK1UfKoRPqha9tdwdofOOD4qr6PQ0UecLyUrUQljlK6QUYm yUQQzC0eun6SdQihPaHGEXK0oe7MqWJvt7s82DE6EKKR8FJ2aqWfMT7qjV3Y3E7e TJzJGDsbLoZYtPl8u6OQM2gaxAf5CqSCxU7PvyOsu5/gf89CsakdC6OUBkXh/pAS wCLDDyqffmgwOi1hE9ACgUOVASRyrITZwP1sqyAVJF8yY3YhxGHImaFrdAJ/yU4Q xp9Ok7v2qSxueDnMc9C16AFt =pWDj -----END PGP SIGNATURE-----
FreeBSD Errata Notice FreeBSD-EN-26:09.tzdata
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-26:09.tzdata Errata Notice The FreeBSD Project Topic: Timezone database information update Category: contrib Module: zoneinfo Announced: 2026-04-29 Affects: All supported versions of FreeBSD. Corrected: 2026-03-05 01:36:15 UTC (stable/15, 15.0-STABLE) 2026-04-29 14:48:25 UTC (releng/15.0, 15.0-RELEASE-p7) 2026-03-05 01:33:16 UTC (stable/14, 14.4-STABLE) 2026-04-29 14:49:38 UTC (releng/14.4, 14.4-RELEASE-p3) 2026-04-29 14:49:18 UTC (releng/14.3, 14.3-RELEASE-p12) 2026-03-05 01:33:52 UTC (stable/13, 13.5-STABLE) 2026-04-29 14:50:16 UTC (releng/13.5, 13.5-RELEASE-p13) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background The IANA Time Zone Database (often called tz or zoneinfo) contains code and data that represent the history of local time for many representative locations around the globe. It is updated periodically to reflect changes made by political bodies to time zone boundaries, UTC offsets, and daylight-saving rules. FreeBSD releases install the IANA Time Zone Database in /usr/share/zoneinfo. The tzsetup(8) utility allows the user to specify the default local time zone. Based on the selected time zone, tzsetup(8) copies one of the files from /usr/share/zoneinfo to /etc/localtime. A time zone may also be selected for an individual process by setting its TZ environment variable to a desired time zone name. II. Problem Description Several changes to future and past timestamps have been recorded in the IANA Time Zone Database after previous FreeBSD releases were released. This affects many users in different parts of the world. Because of these changes, the data in the zoneinfo files need to be updated. If the local timezone on the running system is affected, tzsetup(8) needs to be run to update /etc/localtime. III. Impact An incorrect time will be displayed on a system configured to use one of the affected time zones if the /usr/share/zoneinfo and /etc/localtime files are not updated, and all applications on the system that rely on the system time, such as cron(8) and syslog(8), will be affected. IV. Workaround The system administrator can install an updated version of the IANA Time Zone Database from the misc/zoneinfo port and run tzsetup(8). Applications that store and display times in Coordinated Universal Time (UTC) are not affected. V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Please note that some third party software, for instance PHP, Ruby, Java, Perl and Python, may be using different zoneinfo data sources, in such cases this software must be updated separately. Software packages that are installed via binary packages can be upgraded by executing 'pkg upgrade'. Following the instructions in this Errata Notice will only update the IANA Time Zone Database installed in /usr/share/zoneinfo. Perform one of the following: 1) To update your system installed from base system packages: Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base 2) To update your system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, which were not installed using base system packages, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 3) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 13.5, FreeBSD 14.3, and FreeBSD 15.0] # fetch https://security.FreeBSD.org/patches/EN-26:09/tzdata-2026b.patch # fetch https://security.FreeBSD.org/patches/EN-26:09/tzdata-2026b.patch.asc # gpg --verify tzdata-2026b.patch.asc [FreeBSD 14.4] # fetch https://security.FreeBSD.org/patches/EN-26:09/tzdata-2026b-144.patch # fetch https://security.FreeBSD.org/patches/EN-26:09/tzdata-2026b-144.patch.asc # gpg --verify tzdata-2026b-144.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. Restart all the affected applications and daemons, or reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 564480f108e7 stable/15-n282573 releng/15.0/ 183f96697f82 releng/15.0-n281026 stable/14/ 4830cb713ed8 stable/14-n273807 releng/14.4/ 677aeab69b13 releng/14.4-n273688 releng/14.3/ 1d3ca32f88f2 releng/14.3-n271488 stable/13/ c0b2aff48ff3 stable/13-n259815 releng/13.5/ f7e6b9f128e3 releng/13.5-n259213 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://github.com/eggert/tz/blob/2026b/NEWS> <URL:https://github.com/eggert/tz/blob/2026a/NEWS> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:09.tzdata.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnySRMbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvVGsP/20IASIuyeEzCQSGN/oA u/t7PXGIHre/ApxXzQ+K2A4Sn92f0VAG+SG4g4zdLAI+kQXfdCGq2b0oJoEzQg64 fLAMF772Pc9GMijEXcTMU76hVqD9RiQncOH8w5ODWe3Lmszr8y0foFC9LU0IyccC 5MbHIv9vRRIe0Wpgp33XMLU2mjND+4LVgKxGHpqz86Rqo9zjLAbW1aiSK9mJBE5n BHWWbRpG8lFzm3jx0m7bIZYaghnnuyrg5TV7bZBbMPg64WTFrBrEyS3QlI9addp/ hwxwUY2F14fyyjgnlVOVNsMX/BaDh/c6W8R/EyFVxADjAQazQqJJxO/DTwlxqnbu gaiwdn64vPfR9xJgglsaDutvytEXUMcNuNpDWu8OZUWx1Vd+OnJKLu0m6JC0LLuA LFbq72HyTNoI0I9kpjkY5XBcuPx4DZHzG3WgvgYJ7tO1myUDaKjawAc2khxHsvpf JIsY85kBBEoqXEJiLb5DHVO+2Airldz/8DlHVUMWmds9QrQVo7bQzwRpFMZDDc3b Psp0U9FRe87eQLhgwMn9dRi7QHRRcjAfcqOb3HRHMVRZ2MNq0O9vIRGMyfLzOqwn iweujCGTmSB9tph/StkKv/n+4zzxLOvyJcmSYcz3zLuFq9t2qOeRtQnhD4tn4wLW Kq2ZK/k/IL4g1lI6rg4C3BmF =Mc5t -----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-26:13.exec
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:13.exec Security Advisory The FreeBSD Project Topic: Local privilege escalation via execve() Category: core Module: execve(2) Announced: 2026-04-29 Credits: Ryan of Calif.io Affects: All supported versions of FreeBSD. Corrected: 2026-04-29 14:47:46 UTC (stable/15, 15.0-STABLE) 2026-04-29 14:48:27 UTC (releng/15.0, 15.0-RELEASE-p7) 2026-04-29 14:48:49 UTC (stable/14, 14.4-STABLE) 2026-04-29 14:49:40 UTC (releng/14.4, 14.4-RELEASE-p3) 2026-04-29 14:49:21 UTC (releng/14.3, 14.3-RELEASE-p12) 2026-04-29 14:50:05 UTC (stable/13, 13.5-STABLE) 2026-04-29 14:50:17 UTC (releng/13.5, 13.5-RELEASE-p13) CVE Name: CVE-2026-7270 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background execve(2) is a system call is used to launch an executable image, including scripts prefixed with a path to the interpreter. The system call takes a path to the image as a parameter, followed by extra arguments and environment variables to be passed to the new image. II. Problem Description An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers. III. Impact The bug may be exploitable by an unprivileged user to obtain superuser privileges. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, which were not installed using base system packages, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:13/exec.patch # fetch https://security.FreeBSD.org/patches/SA-26:13/exec.patch.asc # gpg --verify exec.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ c3e943e78e06 stable/15-n283376 releng/15.0/ 934b48683c4f releng/15.0-n281028 stable/14/ ae00a52921ca stable/14-n274075 releng/14.4/ 943aa64ba91a releng/14.4-n273690 releng/14.3/ f04c40607b8f releng/14.3-n271491 stable/13/ d619e3a3c0ec stable/13-n259858 releng/13.5/ 7c5c37ac8f8f releng/13.5-n259214 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-7270> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:13.exec.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnyTiobFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvVDoP/2CASXfMizRLg2uhf7ab Rq2AlXil/b3uDA316fV30LeAEc1X16VVRwuZbOPd8oovXnpt6ACj26Yg+4IsPyU9 ZEMNcm5tA0eEqicFrrVBNxyA41QMwB1S36+tyzoZ3CTWndTAu/5yVLb0VWoniW9S cvf8xULDWBVI48DUKuJ86Bh5aUPNMy2bCMaQc5V88aK5Cc4CG2ZWJu3pJa4+MWq2 CBXgOA3k3qqTIQ5imrRl+9RFYe5WAEnAYNWRauXmQKeJA41bDseUB/Bghy6KY3y+ uuIelphX3pz36cRQd83CIs6IjH0TQ0slizGsmdQ8jVDEbK+kWzSegOo90E8hepQg p929lZbUhpg98G2Fv7cLQ1W7+39dqrqcJubXb0xUcvBp6b9uEUJigRaYJJjxFBUc wtR6sTMqZeyQE/EDubgKMepaY7BWe8K/kDRFzPuGf3LSxZUFtXdsXHixOz6GUBjT oRgtF/QyPIDBlxzWriBI7hbY/4vcQ/XQ7/Q4+x5Q28CNsmw9dmqrolCel8Tvaqmy eFbbIDl+tQn+GolIs9xudzTx4lu1DGYrONoK7Gpb83UxQahkeUEryqhUJApxBskk 3Yt8nG0wWP2U8rZ8JbrWAFNIZU4/j6t+FcFctuh1bnyd88bSuQgEMbcGZ40AP9nS LBz716wDKXX8EOoJT6jjwZ7u =VIf8 -----END PGP SIGNATURE-----
[USN-8225-1] Python marshmallow vulnerabilities
========================================================================== Ubuntu Security Notice USN-8225-1 April 30, 2026 python-marshmallow vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in Python marshmallow. Software Description: - python-marshmallow: ORM/ODM/framework-agnostic library for converting complex datatypes. Details: Jared Deckard discovered that Python marshmallow did not correctly handle hiding certain fields. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-17175) It was discovered that Python marshmallow did not efficiently handle merging certain objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2025-68480) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS python3-marshmallow 3.26.1-0.4ubuntu0.1~esm1 Available with Ubuntu Pro python3-marshmallow-doc 3.26.1-0.4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS python3-marshmallow 3.20.1-1.1ubuntu0.1~esm1 Available with Ubuntu Pro python3-marshmallow-doc 3.20.1-1.1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS python3-marshmallow 3.13.0-1ubuntu0.1~esm1 Available with Ubuntu Pro python3-marshmallow-doc 3.13.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS python3-marshmallow 3.4.0-1ubuntu0.1~esm1 Available with Ubuntu Pro python3-marshmallow-doc 3.4.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS python3-marshmallow 3.0.0b3-1ubuntu0.1~esm1 Available with Ubuntu Pro python3-marshmallow-doc 3.0.0b3-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8225-1 CVE-2018-17175, CVE-2025-68480
FreeBSD Security Advisory FreeBSD-SA-26:17.libnv
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:17.libnv Security Advisory The FreeBSD Project Topic: Heap overflow in libnv Category: core Module: libnv Announced: 2026-04-29 Credits: Mariusz Zaborski Affects: All supported versions of FreeBSD. Corrected: 2026-04-29 14:47:52 UTC (stable/15, 15.0-STABLE) 2026-04-29 14:48:33 UTC (releng/15.0, 15.0-RELEASE-p7) 2026-04-29 14:48:57 UTC (stable/14, 14.4-STABLE) 2026-04-29 14:49:48 UTC (releng/14.4, 14.4-RELEASE-p3) 2026-04-29 14:49:28 UTC (releng/14.3, 14.3-RELEASE-p12) 2026-04-29 14:50:10 UTC (stable/13, 13.5-STABLE) 2026-04-29 14:50:22 UTC (releng/13.5, 13.5-RELEASE-p13) CVE Name: CVE-2026-35547 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background libnv is a general-purpose library designed for storing and exchanging sets of name-value pairs. This library can serve as an Inter-Process Communication (IPC) framework, enabling processes to exchange data and file descriptors. For example, it is used in libcasper to establish communication between privileged and unprivileged processes. Additionally, libnv can function as an interface for communication between userland and kernel. Originally, libnv was inspired by OpenZFS' nvlist implementation. However, the implementations are separate. This advisory relates only to the base system implementation of libnv, not the one in OpenZFS. II. Problem Description When processing the header of an incoming message, libnv failed to properly validate the message size. III. Impact The lack of validation allows a malicious program to write outside the bounds of a heap allocation. This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system installed from base system packages: Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility: # pkg upgrade -r FreeBSD-base # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, which were not installed using base system packages, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-26:17/libnv.patch # fetch https://security.FreeBSD.org/patches/SA-26:17/libnv.patch.asc # gpg --verify libnv.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 414e25d7d512 stable/15-n283381 releng/15.0/ b345e07c8d71 releng/15.0-n281033 stable/14/ 1cbd6e148249 stable/14-n274082 releng/14.4/ 4f0992ce23b0 releng/14.4-n273697 releng/14.3/ aa15809f85de releng/14.3-n271497 stable/13/ 05b91c2a7106 stable/13-n259863 releng/13.5/ f7f48005fbe2 releng/13.5-n259219 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://www.cve.org/CVERecord?id=CVE-2026-35547> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:17.libnv.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnySTgbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvV+cQANyoTjQKCgT/ObIaHIvn /ZHiHhWtxqpnOGHiJQ/Pu32XfF4zngUmxH3RFM4V+p2QTKd+OnCojcr/nWjS1Xh4 D2G0TUYeTfEUzERLxODtWSxD6Px0n7qutRgpTx9yLid3N34av93aoQYnK+1FkqAf PonQlVKqI2Ab44879/Aw4glrjNQg2kGzAwSA4Nzik96BZMePQk6sDnzNKODz914O khZ6KDSc9Fc0jUS4RZUh1AXnAEV2a7vD3fQLg+8aegFiaIajnC4dFZPjl1jioawp 0Jm0f1UI/n5jfp/zyHCJZIgDNvcX+laFnLRJuB8XCrWk8luFdpVOTUjsuPMSA737 TwdSG05ZnGhWsJhQjK0mdkDxoH81wWW7mz21jjVBJ9UhaWhGMNV4mBSevfFYkFkb JHuHO0aCUB6e6/MJ/7O6d0tG9etdQUjCpQeLqXKiYQKqjQkplUUL0C2Uy7A4otEu MelMjHsQMQEjUpRVxX4IADyNQgtJjrroFDdoez3oBF1dfBxQrKkWBnKTTYrV6cbl fIVmkl2b6B/0FcGhAekDh1tLvHj4Ul0n8wzb19F7vT1+4QlnLOtIrXZcJdsTbqde tKRoUYcwvBpUn2bsefxWzEPZ9jvSBoIkSwPmSnu8zQ1jY44eyiHodaXkMsZygplL WfRkGmyutQ0XdUuhcCSyfi/G =K9xn -----END PGP SIGNATURE-----
Wednesday, April 29, 2026
[USN-8223-1] Roundcube Webmail vulnerabilities
========================================================================== Ubuntu Security Notice USN-8223-1 April 29, 2026 roundcube vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Roundcube Webmail. Software Description: - roundcube: skinnable AJAX based webmail solution for IMAP servers - metapackage Details: It was discovered that Roundcube Webmail mishandled Punycode xn-- domain names. An attacker could possibly use this issue to cause a homograph attack. (CVE-2019-15237) It was discovered that Roundcube Webmail did not properly sanitize certain attributes when handling CSS within HTML messages and certain SVG attributes. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-38356, CVE-2024-38357) It was discovered that Roundcube Webmail did not properly sanitize certain HTML attributes when rendering e-mail messages. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-42008) It was discovered that Roundcube Webmail did not properly filter certain CSS token sequences within rendered e-mail messages. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-42010) It was discovered that Roundcube Webmail did not properly treat an SVG tag as an image source within its HTML sanitizer. An attacker could possibly use this issue to bypass remote image blocking to track email open actions or potentially bypass access control. (CVE-2026-25916) It was discovered that Roundcube Webmail did not properly handle comments within Cascading Style Sheets (CSS). An attacker could possibly use this issue to perform a CSS injection attack. (CVE-2026-26079) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS roundcube-core 1.6.6+dfsg-2ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 22.04 LTS roundcube-core 1.5.0+dfsg.1-2ubuntu0.1~esm6 Available with Ubuntu Pro roundcube-plugins 1.5.0+dfsg.1-2ubuntu0.1~esm6 Available with Ubuntu Pro Ubuntu 20.04 LTS roundcube-core 1.4.3+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro roundcube-plugins 1.4.3+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro Ubuntu 18.04 LTS roundcube-core 1.3.6+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro roundcube-plugins 1.3.6+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro Ubuntu 16.04 LTS roundcube-core 1.2~beta+dfsg.1-0ubuntu1+esm8 Available with Ubuntu Pro roundcube-plugins 1.2~beta+dfsg.1-0ubuntu1+esm8 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8223-1 CVE-2019-15237, CVE-2024-38356, CVE-2024-38357, CVE-2024-42008, CVE-2024-42010, CVE-2026-25916, CVE-2026-26079
[USN-8198-2] Tornado vulnerabilities
========================================================================== Ubuntu Security Notice USN-8198-2 April 28, 2026 python-tornado vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS Summary: Several security issues were fixed in Tornado. Software Description: - python-tornado: scalable, non-blocking web server and tools Details: USN-8198-1 fixed vulnerabilities in Tornado. This update provides the corresponding updates for Ubuntu 26.04 LTS. Original advisory details: It was discovered that Tornado incorrectly handled parsing of large multipart request bodies. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-31958) It was discovered that Tornado did not properly validate characters in cookie values. An attacker could possibly use this issue to inject arbitrary cookie attributes. (CVE-2026-35536) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS python3-tornado 6.5.4-0.1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8198-2 https://ubuntu.com/security/notices/USN-8198-1 CVE-2026-31958, CVE-2026-35536 Package Information: https://launchpad.net/ubuntu/+source/python-tornado/6.5.4-0.1ubuntu0.1
[USN-8221-1] wheel vulnerability
========================================================================== Ubuntu Security Notice USN-8221-1 April 29, 2026 wheel vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: wheel could be made to crash or run programs as your login if it opened a specially crafted file. Software Description: - wheel: Command line tool for manipulating Python wheel files Details: It was discovered that wheel did not correctly handle certain file paths. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS python-wheel-common 0.42.0-2ubuntu0.1~esm1 Available with Ubuntu Pro python3-wheel 0.42.0-2ubuntu0.1~esm1 Available with Ubuntu Pro python3-wheel-whl 0.42.0-2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8221-1 CVE-2026-24049
[USN-8195-3] PackageKit vulnerability
========================================================================== Ubuntu Security Notice USN-8195-3 April 29, 2026 packagekit vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: PackageKit could be made to install packages as the administrator. Software Description: - packagekit: Provides a package management service Details: USN-8195-1 fixed a vulnerability in PackageKit. This update provides the corresponding fix to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PackageKit incorrectly handled certain transactions. A local attacker could use this issue to install arbitrary packages as root, possibly resulting in privilege escalation. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS packagekit 1.1.13-2ubuntu1.1+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS packagekit 1.1.9-1ubuntu2.18.04.6+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS packagekit 0.8.17-4ubuntu6~gcc5.4ubuntu1.5+esm1 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8195-3 https://ubuntu.com/security/notices/USN-8195-2 https://ubuntu.com/security/notices/USN-8195-1 CVE-2026-41651
F45 Change Proposal: Versioned_libgit2_packages [SystemWide]
Discussion Thread: https://discussion.fedoraproject.org/t/189891
**This is a proposed Change for Fedora Linux.**
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.
== Summary ==
Going forward, only fully versioned packages for libgit2 will be provided. Dependent libraries and applications are adapted to build and link with the specific libgit2 version they support, and the version-less package names will no longer be provided.
== Owner ==
* Name: [[User:Decathorpe| Fabio Valentini]]
* Email: decathorpe AT gmail DOT com
== Detailed Description ==
Both major and minor versions of libgit2 bring ABI and / or API changes, so applications and libraries that link libgit2 need to be rebuilt for new versions. Using fully versioned package names (or version ranges on pkgconfig dependency specs), packages are adapted to build with the specific libgit2 version they support.
By providing fully versioned package names, it will be possible to introduce newer libgit2 versions to older Fedora releases (and eventually EPEL) transparently and without breaking existing dependencies. As applications are adpated to new libgit2 versions, the oldest provided versions will eventually become unused and can be dropped from Fedora.
* libgit2 (currently v1.9 in Fedora): will be retired
* libgit2_1.9: newly introduced, obsoleting the unversioned package names
* libgit2_1.8: already exists
When libgit2 v2.0.0 is released, it will be packaged as either `libgit2_2.0` or `libgit2_2`, depending on whether libgit2 upstream can finally commit to avoiding ABI changes in minor versions or not.
It is planned to eventually make equivalent changes in EPEL 10 and 9 in order to be able to introduce new parallel-installable libgit2 versions there too.
== Feedback ==
N/Y
== Benefit to Fedora ==
Historically, updates for libgit2 have been tricky due to handle due to frequent ABI changes even in minor versions. Applications that built and worked fine with one version of libgit2 might be subtly broken when built with a different minor version. The corresponding Python bindings (python-pygit2) and bindings for other languages would need to be updated at the same time to avoid even more subtle breakage. Since core build system components like rpmautospec utilize pygit2, issues quickly had a large impact.
By providing fully versioned and parallel-installable packages for different libgit2 versions by default in the future, dependent libraries, applications, and language bindings can be explicitly moved to the next version when things are ready and tested. It also allows introducing newer versions of libgit2 - which often contain fixes for security issues - to older Fedora releases (and eventually, EPEL) transparently without breaking dependent packages.
== Scope ==
* Proposal owners:
Import new libgit2_1.9 package, providing libgit2 v1.9.
Adapt package dependencies to move away from unversioned dependencies.
Retire unversioned libgit2 package from Fedora Rawhide / 45+.
* Other developers:
Adapt package dependencies to move away from unversioned dependencies.
Pull requests for packages where the Change owner is not a co-maintainer will be provided by the Change owner(s).
* Release engineering: [https://forge.fedoraproject.org/releng/tickets/issues/13325 #13325]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
On upgrade, existing installs will be migrated from unversioned libgit2 packages to the versioned equivalents (currently, that would be libgit2_1.9). No actual impact for users is expected.
== Early Testing (Optional) ==
N/A
Do you require 'QA Blueprint' support? Y/N
== How To Test ==
Upgrading to Fedora 45 should remove the libgit2 package and transparently replace it with libgit2_1.9. Packages built against libgit2 v1.9 should depend on libgit2_1.9, and packages built against libgit2 v1.8 should depend on libgit2_1.8, and both should be parallel-installable.
== User Experience ==
No impact to user experience is expected.
== Dependencies ==
**libgit2**:
* R-gert
* R-git2r
* foundry (libfoundry)
* geany-plugins (geany-plugins-git-changebar, geany-plugins-workbench)
* git-evtag
* gnome-builder
* gnuastro
* julia
* kicad
* kommit
* kup-backup
* libgit2-glib
* nix (nix-libs)
* python-pygit2 (python3-pygit2)
* python-rpmautospec (rpmautospec, python3-rpmautospec)
* rpm-git-tag-sort
* rubygem-rugged
* rust (cargo)
* siril
**libgit2-devel** only:
* calligra
* goose
* kf5-ktexteditor
* kf6-ktexteditor
* public-inbox
* ruyi
== Contingency Plan ==
* Contingency mechanism:
If dependent packages cannot be adapted in time, retirement of the unversioned libgit2 package can be postponed to a later release. The package adaptations themselves are backwards compatible and do not need to be reverted.
* Contingency deadline:
Final Freeze
* Blocks release?
No
== Documentation ==
N/A
== Release Notes ==
\nDifferent libgit2 minor versions will all be provided as fully-versioned, parallel-installable packages in order to ensure easy upgrades and migration paths for dependent applications, libraries, and language bindings. The un-versioned libgit2 packages (libgit2, libgit2-devel) were dropped.
-- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[USN-8087-3] python-cryptography vulnerability
========================================================================== Ubuntu Security Notice USN-8087-3 April 28, 2026 python-cryptography vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: python-cryptography could be made to expose sensitive information over the network. Software Description: - python-cryptography: Cryptography Python library Details: USN-8087-1 fixed a vulnerability in python-cryptography. This update provides the corresponding update to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that python-cryptography incorrectly handled subgroup validation for SECT curves. A remote attacker could use this issue to perform a subgroup attack and possibly recover the least significant bits of private keys. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS python-cryptography 2.8-3ubuntu0.3+esm2 Available with Ubuntu Pro python3-cryptography 2.8-3ubuntu0.3+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS python-cryptography 2.1.4-1ubuntu1.4+esm3 Available with Ubuntu Pro python3-cryptography 2.1.4-1ubuntu1.4+esm3 Available with Ubuntu Pro Ubuntu 16.04 LTS python-cryptography 1.2.3-1ubuntu0.3+esm3 Available with Ubuntu Pro python3-cryptography 1.2.3-1ubuntu0.3+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8087-3 https://ubuntu.com/security/notices/USN-8087-2 https://ubuntu.com/security/notices/USN-8087-1 CVE-2026-26007
[USN-8224-1] Linux kernel (BlueField) vulnerabilities
========================================================================== Ubuntu Security Notice USN-8224-1 April 29, 2026 linux-bluefield vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-bluefield: Linux kernel for NVIDIA BlueField platforms Details: Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - x86 architecture; - Cryptographic API; - GPU drivers; - I2C subsystem; - BTRFS file system; - XFRM subsystem; - Padata parallel execution mechanism; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Netfilter; - Network traffic control; - SMC sockets; (CVE-2021-47599, CVE-2022-48875, CVE-2022-49046, CVE-2022-49698, CVE-2024-46816, CVE-2024-49927, CVE-2024-56640, CVE-2025-21726, CVE-2025-21780, CVE-2025-37849, CVE-2025-40019, CVE-2025-40215, CVE-2026-23060, CVE-2026-23074) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS linux-image-5.4.0-1116-bluefield 5.4.0-1116.123 Available with Ubuntu Pro linux-image-bluefield 5.4.0.1116.112 Available with Ubuntu Pro linux-image-bluefield-5.4 5.4.0.1116.112 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-8224-1 https://launchpad.net/bugs/2143853 CVE-2021-47599, CVE-2022-48875, CVE-2022-49046, CVE-2022-49698, CVE-2024-46816, CVE-2024-49927, CVE-2024-56640, CVE-2025-21726, CVE-2025-21780, CVE-2025-37849, CVE-2025-40019, CVE-2025-40215, CVE-2026-23060, CVE-2026-23074, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411,
[USN-8217-1] follow-redirects vulnerabilities
========================================================================== Ubuntu Security Notice USN-8217-1 April 28, 2026 node-follow-redirects vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in follow-redirects. Software Description: - node-follow-redirects: Node.js module that automatically follows HTTP(S) redirects Details: It was discovered that follow-redirects did not properly protect sensitive user information during redirects. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155) It was discovered that follow-redirects did not properly remove sensitive information before storage or transfer. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536) It was discovered that follow-redirects did not properly validate URLs when handling certain inputs. An attacker could possibly use this issue to redirect users to a malicious site, resulting in information disclosure or phishing attacks. (CVE-2023-26159) It was discovered that follow-redirects did not properly clear proxy authentication headers during cross-domain redirects. An attacker could possibly use this issue to cause exposure of sensitive credentials. (CVE-2024-28849) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS node-follow-redirects 1.14.9+~1.14.1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS node-follow-redirects 1.2.4-1ubuntu0.20.04.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS node-follow-redirects 1.2.4-1ubuntu0.18.04.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8217-1 CVE-2022-0155, CVE-2022-0536, CVE-2023-26159, CVE-2024-28849
[USN-8216-1] .NET vulnerabilities
========================================================================== Ubuntu Security Notice USN-8216-1 April 28, 2026 dotnet10 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: Summary: Several security issues were fixed in .NET. Software Description: Details: Ludvig Pedersen discovered that the System.Security.Cryptography.Xml library in .NET incorrectly handled certain XML inputs. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-33116, CVE-2026-26171) Ludvig Pedersen and Kevin Jones discovered that the System.Security.Cryptography.Xml library in .NET incorrectly handled certain XML inputs. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. (CVE-2026-32203) Ludvig Pedersen discovered that the System.Net.Mail component in .NET incorrectly handled certain inputs. An attacker could possibly use this issue to perform a network spoofing attack. (CVE-2026-32178) It was discovered that the Microsoft.AspNetCore.DataProtection library in .NET did not properly verify cryptographic signatures under certain conditions. A remote attacker could possibly use this issue to elevate privileges. (CVE-2026-40372) Update instructions: The problem can be corrected by updating your system to the following package versions: After a standard system update, it is recommended to rotate the DataProtection key ring. References: https://ubuntu.com/security/notices/USN-8216-1 CVE-2026-26171, CVE-2026-32178, CVE-2026-32203, CVE-2026-33116, CVE-2026-40372
Tuesday, April 28, 2026
[USN-8219-1] UltraJSON vulnerabilities
========================================================================== Ubuntu Security Notice USN-8219-1 April 28, 2026 ujson vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in UltraJSON. Software Description: - ujson: Ultra fast JSON encoder and decoder Details: Cameron Criswell discovered that UltraJSON contained a memory leak that would occur when parsing large integers. An attacker could possibly use this issue to cause UltraJSON to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32874) It was discovered that UltraJSON contained integer overflow/underflow issues when calculating how much memory to reserve for indentation in certain instances. An attacker could possibly use this issue to cause UltraJSON to crash, resulting in a denial of service. (CVE-2026-32875) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS python3-ujson 5.11.0-3ubuntu0.1 Ubuntu 25.10 python3-ujson 5.10.0-1ubuntu0.1 Ubuntu 24.04 LTS python3-ujson 5.9.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS python3-ujson 5.1.0-1ubuntu0.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8219-1 CVE-2026-32874, CVE-2026-32875 Package Information: https://launchpad.net/ubuntu/+source/ujson/5.11.0-3ubuntu0.1 https://launchpad.net/ubuntu/+source/ujson/5.10.0-1ubuntu0.1
[USN-8185-2] Linux kernel (Low Latency NVIDIA) vulnerabilities
========================================================================== Ubuntu Security Notice USN-8185-2 April 28, 2026 linux-nvidia-lowlatency vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-nvidia-lowlatency: Linux low latency kernel for NVIDIA systems Details: Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - MIPS architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Network block device driver; - Bluetooth drivers; - Character device driver; - TPM device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - Hardware crypto device drivers; - GPU drivers; - Hardware monitoring drivers; - InfiniBand drivers; - Input Device core drivers; - IOMMU subsystem; - IRQ chip drivers; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - Chrome hardware platform drivers; - x86 platform drivers; - Voltage and Current Regulator drivers; - SCSI subsystem; - SPI subsystem; - Media Oriented Systems Transport (MOST) driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - USB Host Controller drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Watchdog drivers; - BFS file system; - BTRFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS+ file system; - File systems infrastructure; - Journaling layer for block devices (JBD2); - Network file system (NFS) client; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - SMB network file system; - BPF subsystem; - Ethernet bridge; - io_uring subsystem; - Locking primitives; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Tracing infrastructure; - Memory management; - CAIF protocol; - Ceph Core library; - Networking core; - Ethtool driver; - Handshake API; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - Rose network layer; - Network traffic control; - Network sockets; - Sun RPC protocol; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - HD-audio driver; - Turtle Beach Wavefront ALSA driver; - STMicroelectronics SoC drivers; - USB sound devices; - KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS linux-image-6.8.0-1051-nvidia-lowlatency 6.8.0-1051.54.1 linux-image-6.8.0-1051-nvidia-lowlatency-64k 6.8.0-1051.54.1 linux-image-nvidia-lowlatency 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-6.8 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-64k 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-64k-6.8 6.8.0-1051.54.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-8185-2 https://ubuntu.com/security/notices/USN-8185-1 CVE-2024-36347, CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209 Package Information: https://launchpad.net/ubuntu/+source/linux-nvidia-lowlatency/6.8.0-1051.54.1
[USN-8199-1] OpenStack Glance vulnerabilities
========================================================================== Ubuntu Security Notice USN-8199-1 April 22, 2026 glance vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in OpenStack Glance. Software Description: - glance: OpenStack Image Registry and Delivery Service Details: Martin Kaesberger discovered that OpenStack Glance's image processing could return the contents of arbitrary files. An attacker could possibly use this issue to exfiltrate sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-32498) Hyeongeun Ji and Abhishek Kekane discovered several server-side request forgery vulnerabilities in OpenStack Glance's image import. An attacker could possibly use this issue to bypass URL validation checks and redirect to internal services. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-34881) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS glance 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro glance-api 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro glance-common 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro python3-glance 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS glance 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-api 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-common 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-registry 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro python-glance 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS glance 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-api 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-common 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-glare 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-registry 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro python-glance 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8199-1 CVE-2024-32498, CVE-2026-34881
[USN-8210-1] nginx vulnerabilities
========================================================================== Ubuntu Security Notice USN-8210-1 April 27, 2026 nginx vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in nginx. Software Description: - nginx: small, powerful, scalable web/proxy server Details: It was discovered that the nginx ngx_mail_auth_http_module module incorrectly handled certain requests. An attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-27651) It was discovered that the nginx ngx_http_dav_module module incorrectly handled certain destination URIs. An attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly modify source or destination names outside of the document root. (CVE-2026-27654) It was discovered that the nginx ngx_http_mp4_module module incorrectly handled certain MP4 files. An attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-27784, CVE-2026-32647) It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain CRLF sequences. An attacker could possibly use this issue to inject arbitrary SMTP headers. (CVE-2026-28753) It was discovered that the nginx ngx_stream_ssl_module module incorrectly handled revoked certificates. This could result in successful TLS handshakes even after an OCSP check identifies a certificate as revoked, contrary to expectations. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-28755) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 nginx 1.28.0-6ubuntu1.2 nginx-core 1.28.0-6ubuntu1.2 nginx-extras 1.28.0-6ubuntu1.2 nginx-full 1.28.0-6ubuntu1.2 nginx-light 1.28.0-6ubuntu1.2 Ubuntu 24.04 LTS nginx 1.24.0-2ubuntu7.7 nginx-core 1.24.0-2ubuntu7.7 nginx-extras 1.24.0-2ubuntu7.7 nginx-full 1.24.0-2ubuntu7.7 nginx-light 1.24.0-2ubuntu7.7 Ubuntu 22.04 LTS nginx 1.18.0-6ubuntu14.10 nginx-core 1.18.0-6ubuntu14.10 nginx-extras 1.18.0-6ubuntu14.10 nginx-full 1.18.0-6ubuntu14.10 nginx-light 1.18.0-6ubuntu14.10 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8210-1 CVE-2026-27651, CVE-2026-27654, CVE-2026-27784, CVE-2026-28753, CVE-2026-28755, CVE-2026-32647 Package Information: https://launchpad.net/ubuntu/+source/nginx/1.28.0-6ubuntu1.2 https://launchpad.net/ubuntu/+source/nginx/1.24.0-2ubuntu7.7 https://launchpad.net/ubuntu/+source/nginx/1.18.0-6ubuntu14.10
Fedora Linux 44 Final is a GO
The Fedora Linux 44 Final RC-1.7 compose is GO and will be shipped live on Tuesday, 28 April 2026. For more information please check the Go/No-Go meeting minutes[1] or log[2] and our schedule[3]. [1] https://meetbot.fedoraproject.org/meeting_matrix_fedoraproject-org/2026-04-23/f44-final-go-no-go-meeting-2.2026-04-23-18.00.html [2] https://meetbot.fedoraproject.org/meeting_matrix_fedoraproject-org/2026-04-23/f44-final-go-no-go-meeting-2.2026-04-23-18.00.log.html [3] https://fedorapeople.org/groups/schedule/f-44/f-44-key-tasks.html -jef -- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
Fedora Linux 44 is now officially available!
Hello everyone, We’re excited to announce that Fedora Linux 44 is now officially available! This release continues Fedora’s tradition of delivering the latest open-source innovations, bringing together updated packages, improved performance, and enhancements across the desktop, server, and cloud ecosystems. Whether you’re a developer, system administrator, or open-source enthusiast, Fedora Linux 44 offers a refined and reliable experience built on cutting-edge technology. To get started: - Read the official announcement and release highlights: https://fedoramagazine.org/announcing-fedora-linux-44/ - For a fresh installation, download the installer images from: https://fedoraproject.org/ - If you encounter any issues or have questions, visit: https://ask.fedoraproject.org/ - Upgrade your existing Fedora system using the standard upgrade process: https://docs.fedoraproject.org/en-US/quick-docs/upgrading-fedora-offline/ Thanks to all contributors who made this release possible. Regards, Samyak Jain Fedora Project -- _______________________________________________ announce mailing list -- announce@lists.fedoraproject.org To unsubscribe send an email to announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new