[USN-8256-1] opam vulnerability

========================================================================== Ubuntu Security Notice USN-8256-1 May 07, 2026 opam vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: opam could be made to install files in unintended locations if it installed a specially crafted package. Software Description: - opam: package manager for OCaml Details: Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An attacker could use this issue to bypass sandbox protections and write files to arbitrary locations, possibly leading to arbitrary code execution. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS opam 2.5.0-1ubuntu0.1~esm1 Available with Ubuntu Pro opam-installer 2.5.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 25.10 opam 2.3.0-1+deb13u1build0.25.10.1 opam-installer 2.3.0-1+deb13u1build0.25.10.1 Ubuntu 24.04 LTS opam 2.1.5-1ubuntu0.1~esm2 Available with Ubuntu Pro opam-installer 2.1.5-1ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 22.04 LTS opam 2.1.2-1+deb12u1build0.22.04.1 opam-installer 2.1.2-1+deb12u1build0.22.04.1 Ubuntu 20.04 LTS opam 2.0.5-1ubuntu1+esm1 Available with Ubuntu Pro opam-installer 2.0.5-1ubuntu1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8256-1 CVE-2026-41082 Package Information: https://launchpad.net/ubuntu/+source/opam/2.3.0-1+deb13u1build0.25.10.1 https://launchpad.net/ubuntu/+source/opam/2.1.2-1+deb12u1build0.22.04.1